better_auth-sso 0.7.0 → 0.10.0

data/lib/better_auth/sso/plugin/saml_validation_and_state.rb

@@ -0,0 +1,183 @@
+# frozen_string_literal: true
+
+module BetterAuth
+  module Plugins
+    module_function
+
+    def sso_parse_saml_response(value, config = {}, provider = nil, ctx = nil)
+      parser = config.dig(:saml, :parse_response)
+      if parser.respond_to?(:call)
+        sso_validate_single_saml_assertion!(value) if sso_base64_xml?(value)
+        parsed = parser.call(raw_response: value.to_s, provider: provider, context: ctx)
+        return normalize_hash(parsed)
+      end
+
+      JSON.parse(Base64.decode64(value.to_s), symbolize_names: true)
+    rescue APIError
+      raise APIError.new("BAD_REQUEST", message: "Invalid SAML response")
+    rescue
+      raise APIError.new("BAD_REQUEST", message: "Invalid SAML response")
+    end
+
+    def sso_validate_single_saml_assertion!(saml_response)
+      xml = Base64.decode64(saml_response.to_s)
+      raise APIError.new("BAD_REQUEST", message: "Invalid base64-encoded SAML response") unless xml.include?("<")
+
+      assertions = xml.scan(/<(?:\w+:)?Assertion(?:\s|>|\/)/).length
+      encrypted_assertions = xml.scan(/<(?:\w+:)?EncryptedAssertion(?:\s|>|\/)/).length
+      total = assertions + encrypted_assertions
+      raise APIError.new("BAD_REQUEST", message: "SAML response contains no assertions") if total.zero?
+      if total > 1
+        raise APIError.new("BAD_REQUEST", message: "SAML response contains #{total} assertions, expected exactly 1")
+      end
+
+      true
+    rescue APIError
+      raise
+    rescue
+      raise APIError.new("BAD_REQUEST", message: "Invalid base64-encoded SAML response")
+    end
+
+    def sso_validate_saml_timestamp!(conditions, config = {}, now: Time.now.utc)
+      conditions = normalize_hash(conditions || {})
+      not_before = conditions[:not_before] || conditions[:notBefore]
+      not_on_or_after = conditions[:not_on_or_after] || conditions[:notOnOrAfter]
+      if not_before.to_s.empty? && not_on_or_after.to_s.empty?
+        raise APIError.new("BAD_REQUEST", message: "SAML assertion missing required timestamp conditions") if config.dig(:saml, :require_timestamps)
+
+        return true
+      end
+
+      clock_skew_seconds = ((config.dig(:saml, :clock_skew) || SSO_DEFAULT_CLOCK_SKEW_MS).to_f / 1000.0)
+      parsed_not_before = sso_parse_saml_timestamp(not_before, "SAML assertion has invalid NotBefore timestamp") unless not_before.to_s.empty?
+      parsed_not_on_or_after = sso_parse_saml_timestamp(not_on_or_after, "SAML assertion has invalid NotOnOrAfter timestamp") unless not_on_or_after.to_s.empty?
+
+      raise APIError.new("BAD_REQUEST", message: "SAML assertion is not yet valid") if parsed_not_before && now < (parsed_not_before - clock_skew_seconds)
+      raise APIError.new("BAD_REQUEST", message: "SAML assertion has expired") if parsed_not_on_or_after && now > (parsed_not_on_or_after + clock_skew_seconds)
+
+      true
+    end
+
+    def sso_parse_saml_timestamp(value, error_message)
+      Time.parse(value.to_s).utc
+    rescue
+      raise APIError.new("BAD_REQUEST", message: error_message)
+    end
+
+    def sso_saml_timestamp_conditions(assertion)
+      assertion = normalize_hash(assertion || {})
+      conditions = normalize_hash(assertion[:conditions] || {})
+      conditions[:not_before] ||= assertion[:not_before] || assertion[:notBefore]
+      conditions[:not_on_or_after] ||= assertion[:not_on_or_after] || assertion[:notOnOrAfter]
+      conditions
+    end
+
+    def sso_base64_xml?(value)
+      Base64.decode64(value.to_s).lstrip.start_with?("<")
+    rescue
+      false
+    end
+
+    def sso_validate_saml_algorithms!(xml, options = {})
+      on_deprecated = (options[:on_deprecated] || "warn").to_s
+      signature_algorithms = xml.to_s.scan(/SignatureMethod[^>]+Algorithm=["']([^"']+)["']/).flatten.map { |algorithm| sso_normalize_saml_signature_algorithm(algorithm) }
+      digest_algorithms = xml.to_s.scan(/DigestMethod[^>]+Algorithm=["']([^"']+)["']/).flatten.map { |algorithm| sso_normalize_saml_digest_algorithm(algorithm) }
+      key_encryption_algorithms = xml.to_s.scan(/<[^\/>]*EncryptedKey\b[\s\S]*?EncryptionMethod[^>]+Algorithm=["']([^"']+)["']/).flatten
+      data_encryption_algorithms = xml.to_s.scan(/<[^\/>]*EncryptedData\b[\s\S]*?EncryptionMethod[^>]+Algorithm=["']([^"']+)["']/).flatten
+
+      sso_validate_saml_algorithm_group!(
+        signature_algorithms,
+        allowed: options[:allowed_signature_algorithms]&.map { |algorithm| sso_normalize_saml_signature_algorithm(algorithm) },
+        secure: SSO_SAML_SECURE_SIGNATURE_ALGORITHMS,
+        deprecated: ["http://www.w3.org/2000/09/xmldsig#rsa-sha1"],
+        on_deprecated: on_deprecated,
+        label: "signature"
+      )
+      sso_validate_saml_algorithm_group!(
+        digest_algorithms,
+        allowed: options[:allowed_digest_algorithms]&.map { |algorithm| sso_normalize_saml_digest_algorithm(algorithm) },
+        secure: SSO_SAML_SECURE_DIGEST_ALGORITHMS,
+        deprecated: ["http://www.w3.org/2000/09/xmldsig#sha1"],
+        on_deprecated: on_deprecated,
+        label: "digest"
+      )
+      sso_validate_saml_algorithm_group!(
+        key_encryption_algorithms,
+        allowed: options[:allowed_key_encryption_algorithms],
+        secure: SSO_SAML_SECURE_KEY_ENCRYPTION_ALGORITHMS,
+        deprecated: ["http://www.w3.org/2001/04/xmlenc#rsa-1_5"],
+        on_deprecated: on_deprecated,
+        label: "key encryption"
+      )
+      sso_validate_saml_algorithm_group!(
+        data_encryption_algorithms,
+        allowed: options[:allowed_data_encryption_algorithms],
+        secure: SSO_SAML_SECURE_DATA_ENCRYPTION_ALGORITHMS,
+        deprecated: ["http://www.w3.org/2001/04/xmlenc#tripledes-cbc"],
+        on_deprecated: on_deprecated,
+        label: "data encryption"
+      )
+
+      true
+    end
+
+    def sso_normalize_saml_signature_algorithm(algorithm)
+      SSO_SAML_SIGNATURE_ALGORITHMS.fetch(algorithm.to_s.downcase, algorithm.to_s)
+    end
+
+    def sso_normalize_saml_digest_algorithm(algorithm)
+      SSO_SAML_DIGEST_ALGORITHMS.fetch(algorithm.to_s.downcase, algorithm.to_s)
+    end
+
+    def sso_validate_saml_algorithm_group!(algorithms, allowed:, secure:, deprecated:, on_deprecated:, label:)
+      algorithms.each do |algorithm|
+        if allowed
+          next if allowed.include?(algorithm)
+
+          raise APIError.new("BAD_REQUEST", message: "SAML #{label} algorithm not in allow-list: #{algorithm}")
+        end
+
+        if deprecated.include?(algorithm)
+          raise APIError.new("BAD_REQUEST", message: "SAML response uses deprecated #{label} algorithm: #{algorithm}") if on_deprecated == "reject"
+          next
+        end
+        next if secure.include?(algorithm)
+
+        raise APIError.new("BAD_REQUEST", message: "SAML #{label} algorithm not recognized: #{algorithm}")
+      end
+    end
+
+    def sso_generate_saml_relay_state(ctx, state_data)
+      ttl_ms = 10 * 60 * 1000
+      relay_state = BetterAuth::Crypto.random_string(32)
+      now_ms = (Time.now.to_f * 1000).to_i
+      stored = state_data.each_with_object({}) { |(key, value), result| result[key.to_s] = value }.merge(
+        "codeVerifier" => BetterAuth::Crypto.random_string(128),
+        "expiresAt" => now_ms + ttl_ms
+      )
+      ctx.context.internal_adapter.create_verification_value(
+        identifier: "#{SSO_SAML_RELAY_STATE_KEY_PREFIX}#{relay_state}",
+        value: JSON.generate(stored),
+        expiresAt: Time.at((now_ms + ttl_ms) / 1000.0)
+      )
+      ctx.set_signed_cookie("relay_state", relay_state, ctx.context.secret, path: "/", max_age: ttl_ms / 1000, http_only: true, same_site: "lax")
+      relay_state
+    end
+
+    def sso_parse_saml_relay_state(ctx, relay_state)
+      state = sso_verify_state(relay_state, ctx.context.secret)
+      return state if state
+
+      verification = ctx.context.internal_adapter.find_verification_value("#{SSO_SAML_RELAY_STATE_KEY_PREFIX}#{relay_state}")
+      return nil unless verification
+      return nil unless sso_future_time?(verification.fetch("expiresAt"))
+
+      parsed = JSON.parse(verification.fetch("value"))
+      return nil if parsed["expiresAt"].to_i <= (Time.now.to_f * 1000).to_i
+
+      parsed
+    rescue
+      nil
+    end
+  end
+end

data/lib/better_auth/sso/plugin/sign_in_and_oidc_callbacks.rb

@@ -0,0 +1,130 @@
+# frozen_string_literal: true
+
+module BetterAuth
+  module Plugins
+    module_function
+
+    def sso_sign_in_endpoint(config = {})
+      Endpoint.new(path: "/sign-in/sso", method: "POST", metadata: sso_openapi_for(:sign_in)) do |ctx|
+        body = normalize_hash(ctx.body)
+        provider = sso_select_provider(ctx, body, config)
+        provider_type = body[:provider_type].to_s
+        if provider_type == "oidc" && !provider["oidcConfig"]
+          raise APIError.new("BAD_REQUEST", message: "OIDC provider is not configured")
+        end
+        if provider_type == "saml" && !provider["samlConfig"]
+          raise APIError.new("BAD_REQUEST", message: "SAML provider is not configured")
+        end
+        if config.dig(:domain_verification, :enabled) && !(provider.key?("domainVerified") && provider["domainVerified"])
+          raise APIError.new("UNAUTHORIZED", message: "Provider domain has not been verified")
+        end
+
+        state_data = {
+          providerId: provider.fetch("providerId"),
+          callbackURL: body[:callback_url] || "/",
+          errorURL: body[:error_callback_url],
+          newUserURL: body[:new_user_callback_url],
+          requestSignUp: body[:request_sign_up]
+        }
+
+        if provider["oidcConfig"] && provider_type != "saml"
+          provider = sso_ensure_runtime_oidc_provider(ctx, provider, config)
+          pkce = sso_oidc_pkce_state(provider)
+          state = BetterAuth::Crypto.sign_jwt(
+            state_data.merge({nonce: BetterAuth::Crypto.random_string(32)}).merge(pkce.except(:codeVerifier)),
+            ctx.context.secret,
+            expires_in: 600
+          )
+          sso_store_oidc_pkce_verifier(ctx, state, pkce[:codeVerifier]) if pkce[:codeVerifier]
+          url = sso_oidc_authorization_url(provider, ctx, state, config, body)
+        elsif provider["samlConfig"]
+          relay_state = sso_generate_saml_relay_state(ctx, state_data)
+          url = sso_saml_authorization_url(provider, relay_state, ctx, config)
+          sso_store_saml_authn_request(ctx, provider, url, config)
+        else
+          raise APIError.new("BAD_REQUEST", message: "OIDC provider is not configured")
+        end
+        ctx.json({url: url, redirect: true})
+      end
+    end
+
+    def sso_oidc_callback_endpoint(config = {})
+      Endpoint.new(path: "/sso/callback/:providerId", method: "GET") do |ctx|
+        sso_handle_oidc_callback(ctx, config, sso_fetch(ctx.params, :provider_id))
+      end
+    end
+
+    def sso_oidc_shared_callback_endpoint(config = {})
+      Endpoint.new(path: "/sso/callback", method: "GET") do |ctx|
+        state = sso_verify_state(ctx.query[:state] || ctx.query["state"], ctx.context.secret)
+        next ctx.redirect("#{ctx.context.base_url}/error?error=invalid_state") unless state
+
+        sso_handle_oidc_callback(ctx, config, state["providerId"], state: state)
+      end
+    end
+
+    def sso_handle_oidc_callback(ctx, config, provider_id, state: nil)
+      state ||= sso_verify_state(ctx.query[:state] || ctx.query["state"], ctx.context.secret)
+      return ctx.redirect("#{ctx.context.base_url}/error?error=invalid_state") unless state
+
+      callback_url = sso_safe_oidc_redirect_url(ctx, state["callbackURL"] || "/")
+      error_url = sso_safe_oidc_redirect_url(ctx, state["errorURL"] || callback_url)
+      if ctx.query[:error] || ctx.query["error"]
+        error = ctx.query[:error] || ctx.query["error"]
+        description = ctx.query[:error_description] || ctx.query["error_description"]
+        return sso_redirect(ctx, sso_append_error(error_url, error, description))
+      end
+      state_provider_id = state["providerId"] || state[:providerId]
+      if state_provider_id.to_s != provider_id.to_s
+        return sso_redirect(ctx, sso_append_error(error_url, "invalid_state", "provider mismatch"))
+      end
+
+      provider = sso_callback_provider(ctx, config, provider_id)
+      return sso_redirect(ctx, sso_append_error(error_url, "invalid_provider", "provider not found")) unless provider
+      if config.dig(:domain_verification, :enabled) && !(provider.key?("domainVerified") && provider["domainVerified"])
+        raise APIError.new("UNAUTHORIZED", message: "Provider domain has not been verified")
+      end
+
+      provider = sso_ensure_runtime_oidc_provider(ctx, provider, config)
+      oidc_config = sso_provider_config_hash(provider["oidcConfig"])
+      oidc_config[:issuer] ||= provider["issuer"]
+      return sso_redirect(ctx, sso_append_error(error_url, "invalid_provider", "provider not found")) if oidc_config.empty?
+
+      raw_state = ctx.query[:state] || ctx.query["state"]
+      tokens = sso_oidc_tokens(ctx, provider, oidc_config, state, config, raw_state: raw_state)
+      unless tokens
+        return sso_redirect(ctx, sso_append_error(error_url, "invalid_provider", "token_response_not_found"))
+      end
+      if oidc_config[:user_info_endpoint].to_s.empty? && tokens[:id_token] && oidc_config[:jwks_endpoint].to_s.empty?
+        begin
+          provider = sso_ensure_runtime_oidc_provider(ctx, provider, config, require_jwks: true)
+          oidc_config = sso_provider_config_hash(provider["oidcConfig"])
+          oidc_config[:issuer] ||= provider["issuer"]
+        rescue APIError
+          # Fall through to the upstream callback error when JWKS is still unavailable.
+        end
+      end
+      user_info = sso_oidc_user_info(ctx, oidc_config, tokens, config, expected_nonce: state["nonce"] || state[:nonce])
+      if user_info[:_sso_error]
+        return sso_redirect(ctx, sso_append_error(error_url, "invalid_provider", user_info[:_sso_error]))
+      end
+      if user_info[:email].to_s.empty? || user_info[:id].to_s.empty?
+        return sso_redirect(ctx, sso_append_error(error_url, "invalid_provider", "missing_user_info"))
+      end
+      if config[:disable_implicit_sign_up] && !state["requestSignUp"] && !ctx.context.internal_adapter.find_user_by_email(user_info[:email].to_s.downcase)
+        return sso_redirect(ctx, sso_append_error(error_url, "signup disabled"))
+      end
+
+      result = sso_find_or_create_user_result(ctx, provider, user_info, config)
+      return sso_redirect(ctx, sso_append_error(callback_url, result.fetch(:error))) if result[:error]
+
+      if config[:provision_user].respond_to?(:call) && (result.fetch(:created) || config[:provision_user_on_every_login])
+        config[:provision_user].call(user: result.fetch(:user), userInfo: user_info, token: tokens, provider: provider)
+      end
+      session = ctx.context.internal_adapter.create_session(result.fetch(:user).fetch("id"))
+      Cookies.set_session_cookie(ctx, {session: session, user: result.fetch(:user)})
+      redirect_to = (result.fetch(:created) && state["newUserURL"].to_s != "") ? sso_safe_oidc_redirect_url(ctx, state["newUserURL"]) : callback_url
+      sso_redirect(ctx, redirect_to || "/")
+    end
+  end
+end

data/lib/better_auth/sso/routes/schemas.rb

@@ -59,7 +59,7 @@ module BetterAuth
           end
           {
             ssoProvider: {
-              model_name: normalized[:model_name] || "ssoProviders",
+              model_name: normalized[:model_name] || "sso_providers",
               fields: fields
             }
           }

data/lib/better_auth/sso/saml.rb

@@ -66,7 +66,7 @@ module BetterAuth
           name = [given_name, family_name].compact.join(" ").strip
           name = mapped_attribute(attributes, mapping[:name]) || first_attribute(attributes, attribute_map.fetch(:name)) if name.empty?
           extra_fields = mapped_extra_fields(attributes, mapping)
-          email_verified = mapping[:email_verified] ? mapped_attribute(attributes, mapping[:email_verified]) : true
+          email_verified = mapping[:email_verified] ? mapped_attribute(attributes, mapping[:email_verified]) : false
           extra_fields.merge(
             email: email.to_s.downcase,
             name: name.to_s.empty? ? email.to_s : name.to_s,

data/lib/better_auth/sso/version.rb

@@ -2,7 +2,7 @@
 
 module BetterAuth
   module SSO
-    VERSION = "0.7.0"
+    VERSION = "0.10.0"
     PACKAGE_VERSION = VERSION
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: better_auth-sso
 version: !ruby/object:Gem::Version
-  version: 0.7.0
+  version: 0.10.0
 platform: ruby
 authors:
 - Sebastian Sala
@@ -154,7 +154,8 @@ dependencies:
       - !ruby/object:Gem::Version
         version: '1.0'
 description: Adds SSO provider management, OIDC SSO, and SAML SSO integration for
-  Better Auth Ruby.
+  Better Auth Ruby. Better Auth Ruby is an independent modern authentication framework
+  for Ruby inspired by Better Auth.
 email:
 - sebastian.sala.tech@gmail.com
 executables: []
@@ -175,6 +176,16 @@ files:
 - lib/better_auth/sso/oidc/discovery.rb
 - lib/better_auth/sso/oidc/errors.rb
 - lib/better_auth/sso/oidc/types.rb
+- lib/better_auth/sso/plugin/core.rb
+- lib/better_auth/sso/plugin/endpoints.rb
+- lib/better_auth/sso/plugin/oidc_discovery.rb
+- lib/better_auth/sso/plugin/oidc_runtime.rb
+- lib/better_auth/sso/plugin/provider_utils.rb
+- lib/better_auth/sso/plugin/providers.rb
+- lib/better_auth/sso/plugin/saml_metadata_and_logout.rb
+- lib/better_auth/sso/plugin/saml_response.rb
+- lib/better_auth/sso/plugin/saml_validation_and_state.rb
+- lib/better_auth/sso/plugin/sign_in_and_oidc_callbacks.rb
 - lib/better_auth/sso/routes/domain_verification.rb
 - lib/better_auth/sso/routes/helpers.rb
 - lib/better_auth/sso/routes/providers.rb
@@ -192,14 +203,14 @@ files:
 - lib/better_auth/sso/types.rb
 - lib/better_auth/sso/utils.rb
 - lib/better_auth/sso/version.rb
-homepage: https://github.com/sebasxsala/better-auth
+homepage: https://github.com/sebasxsala/better-auth-rb
 licenses:
 - MIT
 metadata:
-  homepage_uri: https://github.com/sebasxsala/better-auth
-  source_code_uri: https://github.com/sebasxsala/better-auth
-  changelog_uri: https://github.com/sebasxsala/better-auth/blob/main/packages/better_auth-sso/CHANGELOG.md
-  bug_tracker_uri: https://github.com/sebasxsala/better-auth/issues
+  homepage_uri: https://github.com/sebasxsala/better-auth-rb
+  source_code_uri: https://github.com/sebasxsala/better-auth-rb
+  changelog_uri: https://github.com/sebasxsala/better-auth-rb/blob/main/packages/better_auth-sso/CHANGELOG.md
+  bug_tracker_uri: https://github.com/sebasxsala/better-auth-rb/issues
 rdoc_options: []
 require_paths:
 - lib