cerner-oauth1a 2.2.0 → 2.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7468ed060ebc8d1eb4f59a5f923a637e88a8ab7ddeac271f9a1850ad2a8cc37d
-  data.tar.gz: d6c61bcf252e4740a72c189f2cfaff78282a1e8e4a86510fbd3613b529e140ae
+  metadata.gz: 97551b442a5cf8e81197726dd7a076fd49ed7e33c5fd2bbf87e27e6368abea4b
+  data.tar.gz: de3ec59f5a000715440492c550bebe4f9d3490ce53fd9d88490a08f7539d7208
 SHA512:
-  metadata.gz: 25930e4cd757e995a2e2766bd9ec8abeaa451300399bfc27e5d49674e6adade90a63f55bd83c396b8483f455b29d60ac0c7a304ed95a537a0460cb2caa508fa0
-  data.tar.gz: 98ce7733b5b2c23721f098acb70e5b4d6290fe7ace38bcb0aaf7e01ab5fc03e88b641822cb7d5cf6a9bda773f47832b1980edfb283c53b11433124ffca36aa51
+  metadata.gz: a98454061208707ddab9eb7a79b867f8acbcd88fa2d42c9e68411a04fa645004e20d282e39efec0f9e91a7a57d88551588324c933e76b8336313a38c24747964
+  data.tar.gz: 6573bfbd3c6ff73b83b957b9b6e784486079b194c9d09c1c4803b16f0336b51376d39ddab369ffdfe5d13ffaa129ecb727256c27f4683169250f7c01fa9498bd

data/CHANGELOG.md

@@ -1,3 +1,8 @@
+# v2.3.0
+Added Protection Realm Equivalence feature to Cerner::OAuth1a::AccessTokenAgent,
+which is used by Cerner::OAuth1a::AccessToken#authenticate when comparing realms.
+This allows for realm aliases, so that the OAuth Service can transition hosts.
+
 # v2.2.0
 Renamed the cache key prefixes from 'cerner-oauth' cache prefixes to 'cerner-oauth1a'.
 

data/README.md

@@ -22,7 +22,7 @@ for implementing a Ruby-based service.
 
     # Setup the AccessTokenAgent with an Access Token Service's URL, a Key and a Secret
     agent = Cerner::OAuth1a::AccessTokenAgent.new(
-      access_token_url: 'https://api.cernercare.com/oauth/access',
+      access_token_url: 'https://oauth-api.cerner.com/oauth/access',
       consumer_key: 'CONSUMER_KEY',
       consumer_secret: 'CONSUMER_SECRET'
     )
@@ -59,7 +59,7 @@ implement that:
     authz_header = request['Authorization']
 
     # Parse the header value
-    access_token = AccessToken.from_authorization_header(authz_header)
+    access_token = Cerner::OAuth1a::AccessToken.from_authorization_header(authz_header)
 
     # Authenticate the Access Token
     # Note: An AccessTokenAgent, configured with a System Account that has been granted privileges

data/lib/cerner/oauth1a/access_token.rb

@@ -168,7 +168,9 @@ module Cerner
       end
 
       # Public: Authenticates the #token against the #consumer_key, #signature and side-channel
-      # secrets exchange via AccessTokenAgent#retrieve_keys.
+      # secrets exchange via AccessTokenAgent#retrieve_keys. If this instance has a #realm set,
+      # then it will compare it to the AccessTokenAgent#realm using the AccessTokenAgent#realm_eql?
+      # method.
       #
       # access_token_agent - An instance of Cerner::OAuth1a::AccessTokenAgent configured with
       #                      appropriate credentials to retrieve secrets via
@@ -182,7 +184,7 @@ module Cerner
       def authenticate(access_token_agent)
         raise ArgumentError, 'access_token_agent is nil' unless access_token_agent
 
-        if @realm && !@realm.eql?(access_token_agent.realm)
+        if @realm && !access_token_agent.realm_eql?(@realm)
           raise OAuthError.new('realm does not match provider', nil, 'token_rejected', nil, access_token_agent.realm)
         end
 

data/lib/cerner/oauth1a/access_token_agent.rb

@@ -19,14 +19,25 @@ module Cerner
     class AccessTokenAgent
       MIME_WWW_FORM_URL_ENCODED = 'application/x-www-form-urlencoded'
 
+      DEFAULT_REALM_ALIASES = {
+        'https://oauth-api.cerner.com' => ['https://api.cernercare.com'].freeze,
+        'https://api.cernercare.com' => ['https://oauth-api.cerner.com'].freeze,
+        'https://oauth-api.sandboxcerner.com' => ['https://api.sandboxcernercare.com'].freeze,
+        'https://api.sandboxcernercare.com' => ['https://oauth-api.sandboxcerner.com'].freeze,
+        'https://oauth-api.devcerner.com' => ['https://api.devcernercare.com'].freeze,
+        'https://api.devcernercare.com' => ['https://oauth-api.devcerner.com'].freeze
+      }.freeze
+
       # Returns the URI Access Token URL.
       attr_reader :access_token_url
       # Returns the String Consumer Key.
       attr_reader :consumer_key
       # Returns the String Consumer Secret.
       attr_reader :consumer_secret
-      # Returns the String Protection Realm. The realm is root of the access_token_url (scheme + hostname).
+      # Returns the String Protection Realm. The realm is root of the access_token_url (Protocol#realm_for).
       attr_reader :realm
+      # Returns the Array of Protection Realm String that are considered equivalent (#realm_eql?) to #realm.
+      attr_reader :realm_aliases
 
       # Public: Constructs an instance of the agent.
       #
@@ -55,6 +66,10 @@ module Cerner
       #                                    #retrieve_keys. (optional, default: true)
       #             :cache_access_tokens - A Boolean for configuring AccessToken caching within
       #                                    #retrieve. (optional, default: true)
+      #             :realm_aliases       - An Array of Strings that provide realm aliases for the
+      #                                    realm that's extracted from :access_token_url. If nil,
+      #                                    this will be initalized with the DEFAULT_REALM_ALIASES.
+      #                                    (optional, default: nil)
       #
       # Raises ArgumentError if access_token_url, consumer_key or consumer_key is nil; if
       #                      access_token_url is an invalid URI.
@@ -65,7 +80,8 @@ module Cerner
         open_timeout: 5,
         read_timeout: 5,
         cache_keys: true,
-        cache_access_tokens: true
+        cache_access_tokens: true,
+        realm_aliases: nil
       )
         raise ArgumentError, 'consumer_key is nil' unless consumer_key
         raise ArgumentError, 'consumer_secret is nil' unless consumer_secret
@@ -74,7 +90,9 @@ module Cerner
         @consumer_secret = consumer_secret
 
         @access_token_url = convert_to_http_uri(access_token_url)
-        @realm = canonical_root_url_for(@access_token_url)
+        @realm = Protocol.realm_for(@access_token_url)
+        @realm_aliases = realm_aliases
+        @realm_aliases ||= DEFAULT_REALM_ALIASES[@realm]
 
         @open_timeout = (open_timeout ? open_timeout.to_i : 5)
         @read_timeout = (read_timeout ? read_timeout.to_i : 5)
@@ -167,6 +185,19 @@ module Cerner
         Time.now.to_i
       end
 
+      # Public: Determines if the passed realm is equivalent to the configured
+      # realm by comparing it to the #realm and #realm_aliases.
+      #
+      # realm - The String to check for equivalence.
+      #
+      # Returns True if the passed realm is equivalent to the configured realm;
+      #   False otherwise.
+      def realm_eql?(realm)
+        return true if @realm.eql?(realm)
+
+        @realm_aliases.include?(realm)
+      end
+
       private
 
       # Internal: Generate a User-Agent HTTP Header string
@@ -218,18 +249,6 @@ module Cerner
         uri
       end
 
-      # Internal: Returns a String containing the canonical root url.
-      #
-      # url - A URL to get the canonical root url String from.
-      #
-      # raises ArgumentError if url is nil.
-      def canonical_root_url_for(url)
-        raise ArgumentError, 'url is nil' unless url
-
-        realm = URI("#{url.scheme}://#{url.host}:#{url.port}")
-        realm.to_s
-      end
-
       # Internal: Prepare a request for #retrieve
       def retrieve_prepare_request(timestamp, nonce, accessor_secret, principal)
         # construct a POST request

data/lib/cerner/oauth1a/protocol.rb

@@ -134,6 +134,22 @@ module Cerner
 
         default
       end
+
+      # Public: Returns a String containing a realm value from the URI. The
+      # String will be a rooted (path removed) and canonicalized URL of the
+      # URL passed.
+      #
+      # uri - A URI instance containing the URL to construct the realm for.
+      #
+      # Returns a String containing the realm value.
+      #
+      # Raises ArgumentError if uri is nil.
+      def self.realm_for(uri)
+        raise ArgumentError, 'uri is nil' unless uri
+
+        realm = URI("#{uri.scheme}://#{uri.host}:#{uri.port}")
+        realm.to_s
+      end
     end
   end
 end

data/lib/cerner/oauth1a/version.rb

@@ -2,6 +2,6 @@
 
 module Cerner
   module OAuth1a
-    VERSION = '2.2.0'
+    VERSION = '2.3.0'
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: cerner-oauth1a
 version: !ruby/object:Gem::Version
-  version: 2.2.0
+  version: 2.3.0
 platform: ruby
 authors:
 - Nathan Beyer
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-04-17 00:00:00.000000000 Z
+date: 2019-05-30 00:00:00.000000000 Z
 dependencies: []
 description: |
   A minimal dependency library for interacting with a Cerner OAuth 1.0a Access
@@ -53,7 +53,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.2
+rubygems_version: 3.0.3
 signing_key: 
 specification_version: 4
 summary: Cerner OAuth 1.0a Consumer and Service Provider Library.