authproto 0.3.0.beta1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 77c4682515836e03bc41e1d03724f5ca2a85e65a11655b2af8a8ba09049a73fc
+  data.tar.gz: 0ba9433f0ee89b8617354d1e0245644f421fc1e7264597391b2efa5ebc015f79
+SHA512:
+  metadata.gz: ebbd4f4c9df22f002bbe9be7c02b502bf4fcf5c056d4d0e9290a2c91dde8f03b4756e3b3db9f306cc1b9d5be6be183b88ace24ddb195733c37e92823ec0d5d78
+  data.tar.gz: 3b96e49a8ea9bbb555dab5996c0e6a53f0894616928c4416199f00561f2d9603cf327d0c868cf66501fd7b5982a8ec985d9e27e5032de274ef8daaccad58dbb4

data/.rspec

@@ -0,0 +1 @@
+--require spec_helper

data/.rubocop.yml

@@ -0,0 +1,31 @@
+AllCops:
+  NewCops: enable
+  SuggestExtensions: false
+  TargetRubyVersion: 3.2
+
+Metrics/BlockLength:
+  Enabled: false
+
+Metrics/ClassLength:
+  Enabled: false
+
+Metrics/ModuleLength:
+  Enabled: false
+
+Metrics/MethodLength:
+  Enabled: false
+
+Metrics/AbcSize:
+  Enabled: false
+
+Metrics/PerceivedComplexity:
+  Enabled: false
+
+Metrics/CyclomaticComplexity:
+  Enabled: false
+
+Style/StringLiterals:
+  EnforcedStyle: double_quotes
+
+Style/StringLiteralsInInterpolation:
+  EnforcedStyle: double_quotes

data/.tm_properties

@@ -0,0 +1 @@
+excludeInFolderSearch = "{$excludeInFolderSearch,coverage,doc}"

data/.yardopts

@@ -0,0 +1,4 @@
+--protected
+--no-private
+--markup markdown
+lib/**/*.rb

data/CHANGELOG.md

@@ -0,0 +1,52 @@
+## [0.2.5] - 2024-12-13
+
+Fixed:
+
+- Additional token refresh edge case handling
+
+## [0.2.4] - 2024-12-13
+
+Fixed:
+
+- Token refresh now correctly handles expired tokens
+
+## [0.2.2] - 2024-12-12
+
+Added:
+
+- Added support for did:web users
+
+## [0.2.1] - 2024-12-11
+
+Fixed:
+
+- Fixed a bug with access token hash generation
+
+## [0.2.0] - 2024-12-10
+
+Added:
+
+- Client#handle_callback now returns session did as part of the response
+
+## [0.1.0] - 2024-12-07
+
+Added:
+
+- Configurable storage backend system for managing OAuth state
+- In-memory storage implementation included by default
+- Redis storage implementation for production environments
+- Thread-safe storage operations with atomic locks
+- Storage encryption for sensitive data
+- Automatic cleanup of expired tokens and session data
+- Storage interface for custom backend implementations
+
+Changed:
+
+- Storage configuration is now required in AtprotoAuth.configure
+- Default configuration uses thread-safe in-memory storage
+- Session and token management now use configured storage backend
+- Improved thread safety for all storage operations
+
+## [0.0.1] - 2024-12-05
+
+- Initial release

data/MIT-LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2024 Josh Huckabee, (c) 2026 Jakub Suder
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -0,0 +1,304 @@
+# AuthProto
+
+[![Gem Version](https://img.shields.io/gem/v/authproto.svg)](https://rubygems.org/gems/authproto)
+[![Documentation](https://img.shields.io/badge/docs-rdoc-blue.svg)](https://www.rubydoc.info/gems/authproto)
+
+A Ruby implementation of the [AT Protocol OAuth specification](https://atproto.com/specs/oauth). This library provides support for both client and server-side implementations, with built-in security features including [DPoP](https://datatracker.ietf.org/doc/html/rfc9449), [PAR](https://datatracker.ietf.org/doc/html/rfc9126), and dynamic client registration.
+
+> [!WARNING]
+> I have inherited this gem from someone else, and haven't fully reviewed all code yet. Consider this an alpha version.
+
+
+## Features
+
+- Complete AT Protocol OAuth 2.0 implementation
+- Secure by default with mandatory DPoP and PKCE
+- Support for confidential (backend) and public clients
+- Thread-safe session and token management
+- Comprehensive identity resolution and verification
+- Automatic token refresh and session management
+- Robust error handling and recovery mechanisms
+- Configurable storage backends with built-in SQLite and Redis support
+- Encrypted storage of sensitive data
+
+## Installation
+
+Add this line to your application's Gemfile:
+
+```ruby
+gem 'authproto'
+```
+
+And then execute:
+
+```sh
+bundle install
+```
+
+Or install it yourself as:
+
+```sh
+gem install authproto
+```
+
+## Requirements
+
+- Ruby 3.3 or higher
+- OpenSSL support
+- For confidential clients: HTTPS-capable domain for client metadata hosting
+- Optional: SQLite or Redis storage adapter gems for production use
+
+## Basic Usage
+
+### Configuration
+
+```ruby
+require 'authproto'
+
+AuthProto.configure do |config|
+  # Configure HTTP client settings
+  config.http_client = AuthProto::HTTPClient.new(
+    timeout: 10,
+    verify_ssl: true
+  )
+
+  # Set token lifetimes
+  config.default_token_lifetime = 300 # 5 minutes
+  config.dpop_nonce_lifetime = 300  # 5 minutes
+
+  # Configure storage backend (default is in-memory)
+  config.storage = AuthProto::Storage::Memory.new
+end
+
+# Storage adapter gems are optional dependencies. Add one of these:
+gem 'sqlite3', '~> 2.9'
+gem 'redis', '~> 5.4'
+```
+
+### Local HTTP debugging
+
+For debugging a flow that needs both local HTTP and remote HTTPS (handle/PLC
+resolution, metadata discovery and OAuth requests), explicitly select:
+
+```ruby
+AuthProto.configure do |config|
+  config.http_client = AuthProto::InsecureHTTPClient.new(timeout: 10)
+end
+```
+
+`InsecureHTTPClient` accepts HTTP and HTTPS, including loopback and private-network
+destinations, and permits redirects between them. It disables the regular client's
+scheme/IP restrictions for development; HTTPS certificate verification stays enabled
+by default. Timeouts, response size limits and request headers are inherited.
+
+The regular `HTTPClient` accepts HTTPS and rejects loopback/private addresses.
+Use it for remote OAuth servers, including when your application's callback is
+local: the browser, rather than this HTTP client, follows the callback redirect.
+
+Client metadata fetches call `get(url, follow_redirects: false)` and require HTTP
+200 with an `application/json` response. Custom HTTP clients must support this
+keyword and return the initial response without following redirects when it is false.
+
+Client metadata must explicitly set `token_endpoint_auth_method` to `none` for
+public clients or `private_key_jwt` for confidential clients. Omitting it defaults
+to `client_secret_basic` in OAuth metadata, which this library does not support.
+
+### Storage Backends
+
+The library supports multiple storage backends for managing OAuth state:
+
+#### In-Memory Storage (Default)
+
+```ruby
+# Default configuration - good for development
+AuthProto.configure do |config|
+  config.storage = AuthProto::Storage::Memory.new
+end
+```
+
+#### SQLite Storage
+
+SQLite can be used for persistent storage in development or in production setups with
+low-to-moderate write concurrency:
+
+```ruby
+AuthProto.configure do |config|
+  config.storage = AuthProto::Storage::SQLite.new(
+    path: '/var/lib/my_app/authproto.sqlite3'
+  )
+end
+```
+
+Add the adapter gem to your Gemfile:
+
+```ruby
+gem 'sqlite3', '~> 2.9'
+```
+
+#### Redis Storage
+
+Use Redis for production deployments with multiple hosts or write-heavy scenarios:
+
+```ruby
+require 'redis'
+
+AuthProto.configure do |config|
+  redis_client = Redis.new(
+    url: ENV['REDIS_URL'],
+    ssl_params: { verify_mode: OpenSSL::SSL::VERIFY_PEER }
+  )
+  
+  config.storage = AuthProto::Storage::Redis.new(
+    redis_client: redis_client
+  )
+end
+```
+
+Add the adapter gem to your Gemfile:
+
+```ruby
+gem 'redis', '~> 5.4'
+```
+
+#### Custom Storage Implementation
+```ruby
+# Implement your own storage backend
+class CustomStorage < AuthProto::Storage::Interface
+  def set(key, value, ttl: nil)
+    # Implementation
+  end
+
+  def get(key)
+    # Implementation
+  end
+
+  def delete(key)
+    # Implementation
+  end
+
+  def exists?(key)
+    # Implementation
+  end
+
+  def with_lock(key, ttl: 30)
+    # Implementation
+  end
+end
+```
+
+### Confidential Client Example
+
+Here's a basic example of using the library in a confidential client application:
+
+```ruby
+# Initialize client with metadata
+client = AuthProto::Client.new(
+  client_id: "https://app.example.com/oauth-client-metadata.json",
+  redirect_uri: "https://app.example.com/callback",
+  metadata: {
+    # Your client metadata...
+  }
+)
+
+# Start authorization flow
+auth = client.authorize(
+  handle: "user.bsky.social",
+  scope: "atproto"
+)
+
+# Use auth[:url] to redirect user
+
+# Handle callback
+tokens = client.handle_callback(
+  code: params[:code],
+  state: params[:state],
+  iss: params[:iss]
+)
+
+# Make authenticated requests
+headers = client.auth_headers(
+  session_id: tokens[:session_id],
+  method: "GET",
+  url: "https://api.example.com/resource"
+)
+```
+
+For a complete working example of a confidential client implementation, check out the example application in `examples/confidential_client/`. This Sinatra-based web application demonstrates:
+- Complete OAuth flow implementation
+- Session management
+- DPoP token binding
+- Making authenticated API requests
+- Proper error handling
+- Key generation and management
+
+See `examples/confidential_client/README.md` for setup instructions and implementation details.
+
+### Public Client Example
+
+```ruby
+client = AuthProto::Client.new(
+  client_id: "https://app.example.com/oauth-client-metadata.json",
+  redirect_uri: "https://app.example.com/callback"
+)
+
+# Browser will open authorization URL
+auth = client.authorize(
+  handle: "user.bsky.social",
+  scope: "atproto"
+)
+
+# After callback, exchange code for tokens
+tokens = client.handle_callback(
+  code: params[:code],
+  state: params[:state],
+  iss: params[:iss]
+)
+```
+
+## Features In Detail
+
+### Identity Resolution
+
+The library uses DIDKit for AT Protocol identity resolution:
+
+- Handle to DID resolution (DNS-based or HTTP fallback)
+- DID document fetching and validation
+- PDS (Personal Data Server) location verification
+- Bidirectional handle verification
+- Authorization server binding verification
+
+### Token & Session Management
+
+Comprehensive token lifecycle management:
+
+- Secure token storage with encryption
+- Automatic token refresh
+- DPoP proof generation and binding
+- Session state tracking
+- Cleanup of expired sessions
+
+### Security Features
+
+Built-in security best practices:
+
+- Mandatory PKCE for all flows
+- DPoP token binding
+- Constant-time token comparisons
+- Thread-safe state management
+- Protection against SSRF attacks
+- Secure encrypted token storage
+- Atomic storage operations with locking
+
+## Development
+
+After checking out the repo, run `bin/setup` to install dependencies. Then, run `bundle exec rspec` (or `bundle exec rake spec`) to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
+
+To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and the created tag, and push the `.gem` file to [rubygems.org](https://rubygems.org).
+
+## Contributing
+
+Bug reports and pull requests are welcome on GitHub at https://github.com/mackuba/authproto.
+
+## License
+
+The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).

data/Rakefile

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+require 'bundler/gem_tasks'
+require 'rspec/core/rake_task'
+
+RSpec::Core::RakeTask.new(:spec)
+
+task default: %i[spec]

data/SECURITY.md

@@ -0,0 +1,16 @@
+# Security Policy
+
+## How To Report a Vulnerability
+
+If you find a potential vulnerability in one of my projects, it's recommended not to report it through a standard publicly-readable issue report, in order to avoid giving possible clues to any potential attackers who could abuse it before it's fixed (see: ["Just a rumour of a bug is enough to find a security exploit these days"](https://anil.recoil.org/notes/rumour-is-the-exploit)).
+
+You can use one of these to contact me instead:
+
+- [@mackuba.eu](https://bsky.app/profile/did:plc:oio4hkxaop4ao4wz2pp3f4cr) on Bluesky (my DMs should be open, or mention me discretely with a request for contact)
+- [@mackuba@martianbase.net](https://martianbase.net/@mackuba) on Mastodon (my personal instance)
+- email: mackuba `@` protonmail.ch (optionally with [this PGP key](https://mail-api.proton.me/pks/lookup?op=get&search=mackuba@protonmail.ch))
+- ["Report a vulnerability"](https://github.com/mackuba/didkit/security/advisories/new) form on GitHub
+
+I do not check my Twitter/X or LinkedIn accounts regularly.
+
+Note: please don't submit AI-reported issues that have not been verified manually :)

data/examples/confidential_client/.gitignore

@@ -0,0 +1,5 @@
+.env
+/config/client-metadata.json
+/config/keys.json
+/db/
+/public/client-metadata.json

data/examples/confidential_client/Gemfile

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+source "https://rubygems.org"
+
+gem "authproto", path: "../.."
+gem "dotenv"
+gem "faraday"
+gem "json"
+gem "puma"
+gem "rackup"
+gem "redis"
+gem "sinatra"
+gem "sinatra-contrib"
+gem "sqlite3", "~> 2.9"

data/examples/confidential_client/Gemfile.lock

@@ -0,0 +1,88 @@
+PATH
+  remote: ../..
+  specs:
+    authproto (0.2.5)
+      jose (~> 1.2)
+      jwt (~> 3.3)
+
+GEM
+  remote: https://rubygems.org/
+  specs:
+    base64 (0.3.0)
+    concurrent-ruby (1.3.8)
+    connection_pool (3.0.2)
+    dotenv (3.2.0)
+    faraday (2.14.3)
+      faraday-net_http (>= 2.0, < 3.5)
+      json
+      logger
+    faraday-net_http (3.4.4)
+      net-http (~> 0.5)
+    immutable-ruby (0.2.0)
+      concurrent-ruby (~> 1.1)
+      sorted_set (~> 1.0)
+    jose (1.2.0)
+      base64
+      immutable-ruby
+    json (2.21.1)
+    jwt (3.3.0)
+      base64
+    logger (1.7.0)
+    multi_json (1.21.1)
+    mustermann (3.1.1)
+    net-http (0.9.1)
+      uri (>= 0.11.1)
+    nio4r (2.7.5)
+    puma (8.0.2)
+      nio4r (~> 2.0)
+    rack (3.2.6)
+    rack-protection (4.2.1)
+      base64 (>= 0.1.0)
+      logger (>= 1.6.0)
+      rack (>= 3.0.0, < 4)
+    rack-session (2.1.2)
+      base64 (>= 0.1.0)
+      rack (>= 3.0.0)
+    rackup (2.3.1)
+      rack (>= 3)
+    rbtree (0.4.7)
+    redis (5.4.1)
+      redis-client (>= 0.22.0)
+    redis-client (0.30.1)
+      connection_pool
+    sinatra (4.2.1)
+      logger (>= 1.6.0)
+      mustermann (~> 3.0)
+      rack (>= 3.0.0, < 4)
+      rack-protection (= 4.2.1)
+      rack-session (>= 2.0.0, < 3)
+      tilt (~> 2.0)
+    sinatra-contrib (4.2.1)
+      multi_json (>= 0.0.2)
+      mustermann (~> 3.0)
+      rack-protection (= 4.2.1)
+      sinatra (= 4.2.1)
+      tilt (~> 2.0)
+    sorted_set (1.1.0)
+      rbtree
+    sqlite3 (2.9.5-arm64-darwin)
+    tilt (2.8.0)
+    uri (1.1.1)
+
+PLATFORMS
+  arm64-darwin-24
+
+DEPENDENCIES
+  authproto!
+  dotenv
+  faraday
+  json
+  puma
+  rackup
+  redis
+  sinatra
+  sinatra-contrib
+  sqlite3 (~> 2.9)
+
+BUNDLED WITH
+  4.0.17