authproto 0.3.0.beta2 → 0.3.0.beta3

data/lib/authproto/dpop/proof_generator.rb

@@ -5,9 +5,10 @@ require 'openssl'
 require 'securerandom'
 require 'uri'
 
+require_relative '../dpop'
 require_relative '../errors'
 require_relative '../validated_uri'
-require_relative 'key_manager'
+require_relative 'key_set'
 
 module AuthProto
   module DPoP
@@ -24,49 +25,33 @@ module AuthProto
       # Error raised for proof generation/validation issues
       class ProofError < AuthProto::Error; end
 
-      # Key manager used to sign proofs.
-      # @return [KeyManager]
-      attr_reader :key_manager
-
-      # Creates a new ProofGenerator instance
-      #
-      # @param key_manager [KeyManager] Key manager to use for signing proofs
-      # @raise [ProofError] if key_manager is invalid
-      #
-      def initialize(key_manager)
-        raise ProofError, "key_manager is required" unless key_manager
-        raise ProofError, "invalid key_manager type" unless key_manager.is_a?(KeyManager)
-
-        @key_manager = key_manager
-      end
-
       # Builds and signs a fresh DPoP JWT with `jti`, `htm`, `htu` and `iat` claims.
       #
-      # A nonce and access-token hash are added when requested. The URI normalizer removes
-      # query strings, fragments and default ports.
+      # Includes a nonce when provided and an access-token hash whenever an access token
+      # is supplied. The URI normalizer removes query strings, fragments and default ports.
       #
+      # @param key_set [KeySet] key belonging to the session making this request
       # @param method [String] nonempty HTTP method, converted to uppercase
       # @param uri [String] absolute HTTP(S) request URL
       # @param nonce [String, nil] server-provided nonce to include
       # @param access_token [String, nil] access token to bind to the proof
-      # @param ath [Boolean, nil] include an access-token hash; `nil` enables it when a token is supplied
       # @return [JOSE::SignedBinary] compact signed DPoP JWT
       # @raise [ProofError] if input validation or proof generation fails
       #
-      def generate(method:, uri:, nonce: nil, access_token: nil, ath: nil)
+      def generate(key_set:, method:, uri:, nonce: nil, access_token: nil)
+        raise ProofError, "invalid key_set type" unless key_set.is_a?(KeySet)
+
         validate_inputs(method, uri)
-        ath = !access_token.nil? if ath.nil?
 
-        header = build_header
+        header = build_header(key_set)
         payload = build_payload(
           method: method,
           uri: uri,
           nonce: nonce,
-          access_token: access_token,
-          include_ath: ath
+          access_token: access_token
         )
 
-        key_manager.sign_segments(header, payload)
+        key_set.sign_segments(header, payload)
       rescue StandardError => e
         raise ProofError, "Failed to generate proof: #{e.message}"
       end
@@ -82,15 +67,15 @@ module AuthProto
         raise ProofError, "invalid uri: #{e.message}"
       end
 
-      def build_header
+      def build_header(key_set)
         {
           typ: 'dpop+jwt',
-          alg: 'ES256',
-          jwk: key_manager.public_jwk.to_h
+          alg: ALGORITHM,
+          jwk: key_set.public_jwk
         }
       end
 
-      def build_payload(method:, uri:, nonce: nil, access_token: nil, include_ath: nil)
+      def build_payload(method:, uri:, nonce: nil, access_token: nil)
         payload = {
           'jti' => SecureRandom.uuid,
           'htm' => method.upcase,
@@ -101,8 +86,8 @@ module AuthProto
         # Add the nonce if provided
         payload['nonce'] = nonce if nonce
 
-        # Add access token hash if needed
-        payload['ath'] = generate_access_token_hash(access_token) if access_token && include_ath
+        # Bind the proof to the access token whenever one is supplied
+        payload['ath'] = generate_access_token_hash(access_token) unless access_token.nil?
 
         payload
       end

data/lib/authproto/dpop.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module AuthProto
+
+  #
+  # Demonstrating Proof of Possession (DPoP) signing and request authentication.
+  #
+
+  module DPoP
+
+    # JWS signing algorithm used for DPoP proofs.
+    # @return [String]
+    ALGORITHM = "ES256"
+
+    # OAuth error value requesting a retry with a server-provided DPoP nonce.
+    # @return [String]
+    ERROR_USE_NONCE = "use_dpop_nonce"
+  end
+end

data/lib/authproto/http_helpers.rb

@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+require 'strscan'
+
+module AuthProto
+
+  #
+  # Shared helpers for HTTP response hashes returned by the configured transport.
+  #
+
+  module HTTPHelpers
+
+    private
+
+    # Looks up a response header without regard to the case of its name.
+    #
+    # @param response [Hash{Symbol => Object}] HTTP response with an optional `:headers` hash
+    # @param name [String] header name, in any case
+    # @param strip_parameters [Boolean] return only the trimmed value before the first semicolon
+    # @return [String, nil] header value, or `nil` if the header or headers hash is absent
+    #
+    def response_header(response, name, strip_parameters: false)
+      value = (response[:headers] || {}).find { |header, value| header.casecmp?(name) }&.last
+      return value unless value && strip_parameters
+
+      value.split(';', 2).first.to_s.strip
+    end
+
+    # Finds an authentication scheme in a WWW-Authenticate challenge list.
+    # Quoted commas and escapes are preserved while parsing. Scheme and parameter
+    # names are case-insensitive; parameter values retain their original case.
+    #
+    # @param header [String, nil] combined WWW-Authenticate header value
+    # @param scheme [String] authentication scheme to select
+    # @return [Hash{String => String}, nil] parameters, or `nil` for absent, malformed or multiple matching challenges
+    #
+    def authentication_challenge(header, scheme:)
+      return nil unless header.is_a?(String)
+
+      scanner = StringScanner.new(header)
+      matches = []
+      scanner.skip(/[ \t]*/)
+
+      loop do
+        name = scanner.scan(/[!#$%&'*+\-.^_`|~0-9A-Za-z]+/)
+        return nil unless name
+
+        whitespace = scanner.skip(/[ \t]*/)
+        params = {}
+
+        unless scanner.eos? || scanner.check(/,/)
+          return nil if whitespace.zero?
+
+          # Other schemes can carry token68 credentials rather than parameters.
+          unless scanner.scan(/[A-Za-z0-9\-._~+\/]+=*(?=[ \t]*(?:,|\z))/)
+            loop do
+              parameter = scanner.scan(/[!#$%&'*+\-.^_`|~0-9A-Za-z]+/)&.downcase
+              return nil unless parameter && !params.key?(parameter)
+
+              scanner.skip(/[ \t]*/)
+              return nil unless scanner.scan(/=/)
+
+              scanner.skip(/[ \t]*/)
+              value = scanner.scan(/"(?:\\.|[^"\\])*"/) || scanner.scan(/[!#$%&'*+\-.^_`|~0-9A-Za-z]+/)
+              return nil unless value
+
+              params[parameter] = value.start_with?('"') ? value[1...-1].gsub(/\\(.)/, '\\1') : value
+              scanner.skip(/[ \t]*/)
+              break unless scanner.check(/,[ \t]*[!#$%&'*+\-.^_`|~0-9A-Za-z]+[ \t]*=/)
+
+              scanner.scan(/,[ \t]*/)
+            end
+          end
+        end
+
+        matches << params if name.casecmp?(scheme)
+        scanner.skip(/[ \t]*/)
+        break if scanner.eos?
+        return nil unless scanner.scan(/,[ \t]*/)
+      end
+
+      matches.one? ? matches.first : nil
+    end
+  end
+end

data/lib/authproto/metadata/authorization_server.rb

@@ -4,9 +4,12 @@ require 'json'
 require 'uri'
 
 require_relative '../configuration'
+require_relative '../dpop'
 require_relative '../errors'
 require_relative '../http_client'
+require_relative '../http_helpers'
 require_relative '../metadata'
+require_relative '../par/client_assertion'
 require_relative '../validated_uri'
 
 module AuthProto
@@ -34,6 +37,7 @@ module AuthProto
     #
 
     class AuthorizationServer
+      extend HTTPHelpers
 
       # Metadata keys that must be present before capability validation.
       # @return [Array<String>]
@@ -258,8 +262,10 @@ module AuthProto
           @token_endpoint_auth_signing_alg_values_supported, 'token_endpoint_auth_signing_alg_values_supported'
         )
 
-        unless @token_endpoint_auth_signing_alg_values_supported.include?('ES256')
-          raise InvalidAuthorizationServer, "token_endpoint_auth_signing_alg_values_supported must include ES256"
+        algorithm = PAR::ClientAssertion::ALGORITHM
+
+        unless @token_endpoint_auth_signing_alg_values_supported.include?(algorithm)
+          raise InvalidAuthorizationServer, "token_endpoint_auth_signing_alg_values_supported must include #{algorithm}"
         end
 
         if @token_endpoint_auth_signing_alg_values_supported.include?('none')
@@ -270,8 +276,8 @@ module AuthProto
       def validate_dpop_signing_algs
         validate_string_array(@dpop_signing_alg_values_supported, 'dpop_signing_alg_values_supported')
 
-        unless @dpop_signing_alg_values_supported.include?('ES256')
-          raise InvalidAuthorizationServer, "dpop_signing_alg_values_supported must include ES256"
+        unless @dpop_signing_alg_values_supported.include?(DPoP::ALGORITHM)
+          raise InvalidAuthorizationServer, "dpop_signing_alg_values_supported must include #{DPoP::ALGORITHM}"
         end
       end
 
@@ -328,9 +334,9 @@ module AuthProto
             raise InvalidAuthorizationServer, "Authorization server metadata must return HTTP 200"
           end
 
-          content_type = response[:headers]["content-type"].to_s.split(";", 2).first.to_s.strip
+          content_type = response_header(response, 'Content-Type', strip_parameters: true)
 
-          unless content_type.casecmp?('application/json')
+          unless content_type.to_s.casecmp?('application/json')
             raise InvalidAuthorizationServer, "Authorization server metadata must use application/json"
           end
         end

data/lib/authproto/metadata/client_metadata.rb

@@ -1,12 +1,14 @@
 # frozen_string_literal: true
 
-require 'json'
 require 'jose'
+require 'json'
 require 'uri'
 
 require_relative '../configuration'
 require_relative '../errors'
+require_relative '../http_helpers'
 require_relative '../metadata'
+require_relative '../par/client_assertion'
 require_relative '../validated_uri'
 
 module AuthProto
@@ -45,6 +47,7 @@ module AuthProto
     #
 
     class ClientMetadata
+      extend HTTPHelpers
 
       # Client authentication method for confidential clients
       AUTH_METHOD_PRIVATE_KEY_JWT = "private_key_jwt"
@@ -166,9 +169,9 @@ module AuthProto
             "expected HTTP 200 response for client metadata request, got #{response[:status]}"
         end
 
-        content_type = (response[:headers] || {}).find { |name, _| name.downcase == 'content-type' }&.last
+        content_type = response_header(response, 'Content-Type', strip_parameters: true)
 
-        unless content_type.to_s.split(';', 2).first.to_s.strip.downcase == 'application/json'
+        unless content_type.to_s.downcase == 'application/json'
           raise InvalidClientMetadata, "client metadata Content-Type must be application/json"
         end
 
@@ -472,6 +475,8 @@ module AuthProto
         raise InvalidClientMetadata, "jwks must have a 'keys' array" unless jwks['keys'].is_a?(Array)
         raise InvalidClientMetadata, "jwks must contain at least one public key" if jwks['keys'].empty?
 
+        key_ids = Set.new
+
         jwks['keys'].each_with_index do |key, index|
           path = "jwks.keys.#{index}"
 
@@ -481,6 +486,12 @@ module AuthProto
             raise InvalidClientMetadata, "#{path} must have a nonempty string kid"
           end
 
+          if key_ids.include?(key['kid'])
+            raise InvalidClientMetadata, "#{path} has a duplicate kid: #{key['kid']}"
+          end
+
+          key_ids << key['kid']
+
           if %w[d p q dp dq qi oth k].any? { |field| key.key?(field) }
             raise InvalidClientMetadata, "#{path} must contain only public key material"
           end
@@ -561,8 +572,10 @@ module AuthProto
       end
 
       def validate_auth_confidential(metadata)
-        unless @token_endpoint_auth_signing_alg == 'ES256'
-          raise InvalidClientMetadata, "token_endpoint_auth_signing_alg must be ES256"
+        algorithm = PAR::ClientAssertion::ALGORITHM
+
+        unless @token_endpoint_auth_signing_alg == algorithm
+          raise InvalidClientMetadata, "token_endpoint_auth_signing_alg must be #{algorithm}"
         end
 
         if @jwks.nil? && @jwks_uri.nil?

data/lib/authproto/metadata/resource_server.rb

@@ -6,6 +6,7 @@ require 'uri'
 require_relative '../configuration'
 require_relative '../errors'
 require_relative '../http_client'
+require_relative '../http_helpers'
 require_relative '../metadata'
 require_relative '../validated_uri'
 
@@ -21,6 +22,7 @@ module AuthProto
     #
 
     class ResourceServer
+      extend HTTPHelpers
 
       # The single authorization server origin advertised by the resource server.
       # @return [String]
@@ -107,9 +109,9 @@ module AuthProto
             raise InvalidAuthorizationServer, "Resource server metadata must return HTTP 200"
           end
 
-          content_type = response[:headers]["content-type"].to_s.split(";", 2).first.to_s.strip
+          content_type = response_header(response, 'Content-Type', strip_parameters: true)
 
-          unless content_type.casecmp?("application/json")
+          unless content_type.to_s.casecmp?("application/json")
             raise InvalidAuthorizationServer, "Resource server metadata must use application/json"
           end
         end

data/lib/authproto/minisky.rb

@@ -6,6 +6,7 @@ require 'net/http'
 require 'uri'
 
 require_relative 'client'
+require_relative 'http_helpers'
 
 #
 # Experimental Minisky client backed by an AuthProto session.
@@ -13,6 +14,7 @@ require_relative 'client'
 #
 
 class Minisky::OAuthClient
+  include AuthProto::HTTPHelpers
   include Minisky::Requests
 
   # Maximum authenticated XRPC retries after nonce challenges.
@@ -41,14 +43,14 @@ class Minisky::OAuthClient
   # @param redirect_uri [String] registered callback URI
   # @param metadata [Hash{String => Object}, nil] preloaded metadata, or `nil` to fetch it
   # @param signing_key [Hash, JOSE::JWK, nil] private ES256 key for confidential-client authentication
-  # @param dpop_key [Hash{String => Object}, nil] existing private DPoP JWK, or `nil` to generate one
+  # @param session_id [String, nil] stored session ID to resume; `nil` starts without an attached session
   #
   # @raise [AuthProto::InvalidClientMetadata] if metadata is invalid or unavailable
   # @raise [AuthProto::Error] if OAuth client or DPoP initialization fails
   # @raise [AuthProto::HTTPClient::HTTPError, AuthProto::HTTPClient::SSRFError] if fetching metadata fails
   # @see AuthProto::Client#initialize
   #
-  def initialize(host, client_id:, redirect_uri:, metadata: nil, dpop_key: nil, signing_key: nil, session_id: nil)
+  def initialize(host, client_id:, redirect_uri:, metadata: nil, signing_key: nil, session_id: nil)
     @host = host
     @session_id = session_id
 
@@ -59,7 +61,6 @@ class Minisky::OAuthClient
       client_id: client_id,
       redirect_uri: redirect_uri,
       metadata: metadata,
-      dpop_key: dpop_key,
       signing_key: signing_key
     )
   end
@@ -87,19 +88,22 @@ class Minisky::OAuthClient
 
   # Completes OAuth authorization and remembers the authenticated session ID.
   #
+  # @param expected_session_id [String] pending session ID retained in the initiating browser session or native context
   # @param options [Hash{Symbol => String}] callback parameters forwarded to {AuthProto::Client#handle_callback}
   # @option options [String] :code authorization code
   # @option options [String] :state callback state token
   # @option options [String] :iss authorization server issuer
   #
   # @return [Hash{Symbol => String, Integer, nil}] token and session details from the OAuth client
-  # @raise [AuthProto::Client::CallbackError] if state or issuer validation fails
+  # @raise [AuthProto::Client::CallbackError] if expected session, state or issuer validation fails
   # @raise [AuthProto::Client::TokenError] if token exchange or validation fails
   # @raise [AuthProto::Error] if proofs, storage or serialization fail
   # @see AuthProto::Client#handle_callback
   #
-  def handle_callback(**options)
-    oauth_client.handle_callback(**options).tap { |result| @session_id = result.fetch(:session_id) }
+  def handle_callback(expected_session_id:, **options)
+    oauth_client.handle_callback(**options, expected_session_id: expected_session_id).tap do |result|
+      @session_id = result.fetch(:session_id)
+    end
   end
 
   # Sends an XRPC GET through Minisky, adding OAuth handling when authenticated.
@@ -117,7 +121,7 @@ class Minisky::OAuthClient
   # @raise [ArgumentError] if the method is invalid or `auth` is a truthy non-Boolean value
   # @raise [Minisky::AuthError] if no completed OAuth login or refresh capability is available
   # @raise [Minisky::BadResponse] if the final response has an error or redirect status
-  # @raise [AuthProto::DPoP::Client::Error] if proof handling fails or a nonce challenge lacks its nonce
+  # @raise [AuthProto::DPoP::Client::Error] if proof handling fails or any DPoP response lacks a valid nonce
   # @raise [AuthProto::Error] if OAuth refresh or token persistence fails
   # @raise [JSON::ParserError] if a JSON response cannot be parsed
   # @raise [Net::OpenTimeout, Net::ReadTimeout, IOError, SystemCallError] if HTTP transport fails
@@ -152,7 +156,7 @@ class Minisky::OAuthClient
   # @raise [ArgumentError] if the method is invalid or `auth` is a truthy non-Boolean value
   # @raise [Minisky::AuthError] if no completed OAuth login or refresh capability is available
   # @raise [Minisky::BadResponse] if the final response has an error or redirect status
-  # @raise [AuthProto::DPoP::Client::Error] if proof handling fails or a nonce challenge lacks its nonce
+  # @raise [AuthProto::DPoP::Client::Error] if proof handling fails or any DPoP response lacks a valid nonce
   # @raise [AuthProto::Error] if OAuth refresh or token persistence fails
   # @raise [JSON::ParserError] if a JSON response cannot be parsed
   # @raise [Net::OpenTimeout, Net::ReadTimeout, IOError, SystemCallError] if HTTP transport fails
@@ -196,6 +200,7 @@ class Minisky::OAuthClient
   # @raise [AuthProto::Client::TokenError] if the session cannot be refreshed
   # @raise [AuthProto::Token::RefreshError] if refresh fails
   # @raise [AuthProto::Storage::StorageError] if token persistence fails
+  # @raise [AuthProto::DPoP::Client::Error] if a refresh response has a missing or invalid nonce
   #
   def perform_token_refresh
     oauth_client.refresh_token(session_id)
@@ -209,14 +214,17 @@ class Minisky::OAuthClient
   #
   def check_access
     session = oauth_client.session_manager.get_session(session_id) if session_id
-    raise Minisky::AuthError, "Complete OAuth login before making authenticated requests" unless session&.tokens
-
-    return :ok unless session.tokens.expired?
-
-    raise Minisky::AuthError, "OAuth session cannot be refreshed; log in again" unless session.renewable?
 
-    perform_token_refresh
-    :refreshed
+    if !session || session.pending?
+      raise Minisky::AuthError, "Complete OAuth login before making authenticated requests"
+    elsif session.tokens_valid?
+      :ok
+    elsif session.renewable?
+      perform_token_refresh
+      :refreshed
+    else
+      raise Minisky::AuthError, "OAuth session cannot be refreshed; log in again"
+    end
   end
 
 
@@ -237,35 +245,29 @@ class Minisky::OAuthClient
 
       request = request_class.new(url, request_headers)
       request.body = body unless body.nil?
+
       response = make_request(request)
+      response_hash = { status: response.code.to_i, headers: response.each_header.to_h, body: response.body }
 
-      nonce = response["DPoP-Nonce"]
-      oauth_client.dpop_client.process_response(response.each_header.to_h, url.to_s) if nonce && !nonce.empty?
-      error = authentication_error(response)
+      oauth_client.dpop_client.process_response(response_hash, server_url: url.to_s, session_id: session_id)
 
-      if response.code.to_i == 401 && error == AuthProto::DPoP::ERROR_USE_NONCE
-        unless nonce && !nonce.empty?
-          raise AuthProto::DPoP::Client::Error, "DPoP nonce challenge (HTTP 401) is missing DPoP-Nonce"
-        end
+      if oauth_client.dpop_client.has_nonce_error?(response_hash)
         return response if nonce_retries >= MAX_NONCE_RETRIES
-
         nonce_retries += 1
-      elsif response.code.to_i == 401 && error == "invalid_token" && !refreshed
-        perform_token_refresh
-        refreshed = true
       else
-        return response
+        error = authentication_error(response)
+
+        if response.code.to_i == 401 && error == "invalid_token" && !refreshed
+          perform_token_refresh
+          refreshed = true
+        else
+          return response
+        end
       end
     end
   end
 
   def authentication_error(response)
-    # Only interpret a single DPoP challenge. Leave other auth schemes and
-    # ambiguous multi-challenge headers to Minisky's normal error handling.
-    challenge = response["WWW-Authenticate"].to_s
-    return unless challenge.match?(/\ADPoP\s/i)
-    return if challenge.match?(/,\s*(?:Bearer|Basic|DPoP)\b/i)
-
-    challenge[/\berror\s*=\s*"(use_dpop_nonce|invalid_token)"/i, 1]
+    authentication_challenge(response['WWW-Authenticate'], scheme: 'DPoP')&.fetch('error', nil)
   end
 end