devise-sssecrets 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 621c723b76901be8d81412e1f45769c7852e96b5e1be9aff5a06e2d62e9b9b1b
+  data.tar.gz: a4209d93c6b96a236e00976763975b61b027d63a44d2752a45c3ebeaea1e1070
+SHA512:
+  metadata.gz: f771b4a63f571024bc822347f914c8f92cb63fae01c3a999b0ca21aa218b5d18c49195ff441c55c4de5cfee3bdee8659e360cc90fbe6622f0d2d58ce9fc6d1e9
+  data.tar.gz: 7996c2c639367c0e6f75a1f6f75a83c7307e205c42d3ed9024bf7e779411ceda6a1f211b4121e98fe8e289024e3c73ccc54996c5c282eec372fa782b465fb460

data/.rspec

@@ -0,0 +1,3 @@
+--format documentation
+--color
+--require spec_helper

data/.rubocop.yml

@@ -0,0 +1,13 @@
+AllCops:
+  TargetRubyVersion: 2.6
+
+Style/StringLiterals:
+  Enabled: true
+  EnforcedStyle: double_quotes
+
+Style/StringLiteralsInInterpolation:
+  Enabled: true
+  EnforcedStyle: double_quotes
+
+Layout/LineLength:
+  Max: 120

data/LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2023 Charlton Trezevant
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -0,0 +1,96 @@
+# Devise::Sssecrets - Sssecrets For Devise's Friendly Token Generator
+
+## Purpose
+
+[Sssecrets](https://github.com/chtzvt/sssecrets) is a handy gem for generating secure tokens that are easy for static analysis tools to identify. It works great as a standalone tool, but there are cases where developers may want to integrate it with authentication frameworks like [Devise](https://github.com/heartcombo/devise). 
+
+This gem provides a module to use sssecrets with Devise as a drop-in replacement for the framework's [built-in friendly token generator](https://github.com/heartcombo/devise/blob/main/lib/devise.rb#L507). By introducing the use of sssecrets for token generation and enabling the configuration of token prefixes and organizations, developers can generate secure and unique tokens with consistent, configurable, identifiable prefixes to suit various use cases.
+
+To learn more about the sssecrets gem and the case for using structured secrets in your application, check out the [Sssecrets repository](https://github.com/chtzvt/sssecrets).
+
+## Why Structured Secrets?
+
+If you're a developer and your application issues some kind of access tokens (API keys, PATs, etc), it's important to format these in a way that both identifies the string as a secret token and provides insight into its permissions.
+
+[Simple Structured Secrets](https://github.com/chtzvt/sssecrets) help solve this problem: They're a compact format with properties that are optimized for detection with static analysis tools. That makes it possible to automatically detect when secrets are leaked in a codebase using features like [GitHub Secret Scanning](https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning) or GitLab Secret Detection.
+
+Here's an example. HashiCorp Vault's API access tokens look like this ([ref](https://developer.hashicorp.com/vault/api-docs#authentication)):
+
+`f3b09679-3001-009d-2b80-9c306ab81aa6`
+
+You might think that this is pretty is a pretty easy pattern to search for, but here's the issue: It's just a [UUID string](https://en.wikipedia.org/wiki/Universally_unique_identifier).
+
+While random, strings in this format are used in many places for non-sensitive purposes. Meaning that, given a random UUID formatted string, it's impossible to know whether it's a sensitive API credential or a garden-variety identifier for something mundane. In cases like these, secret scanning can't help much.
+
+### Prefix Configuration
+
+Token prefixes are a simple and effective method to make tokens identifiable. [Slack](https://api.slack.com/authentication/token-types), [Stripe](https://stripe.com/docs/api/authentication), [GitHub](https://github.blog/2021-04-05-behind-githubs-new-authentication-token-formats/#identifiable-prefixes), and others have adopted this approach to great effect. 
+
+Sssecrets allows you to provide two abbreviated strings, `org` and `type`, which together make up the token prefix. Generally, `org` would be used to specify an overarching identifier (like your company or app), while `type` is intended to identify the token type (i.e., OAuth tokens, refresh tokens, etc) in some way. To maintain a compact and consistent format for Sssecret tokens, `org` and `type` together should not exceed 10 characters in length.
+
+The overridden `Devise#friendly_token` implementation has been extended to accept two optional parameters:
+
+- `prefix_type`: Specifies the type of the token prefix. If not provided, it defaults to `:default`.
+
+- `org`: Specifies the organization for the friendly token. If not provided, the default organization is used.
+
+_Note: the [original implementation's](https://github.com/heartcombo/devise/blob/main/lib/devise.rb#L507) `length` parameter is now ignored._
+
+## How to Use
+
+Before you begin, add `devise-sssecrets` to your gemfile and install it.
+
+1. Open your Devise initializer file at `config/initializers/devise.rb`.
+
+2. Use the `Devise.setup` block to configure your token organization and types.
+
+```ruby
+Devise.setup do |config|
+  config.friendly_token_org = 'dv' # Set your sssecret token organization. Defaults to "dv".
+  config.friendly_token_types[:default] = 'ft' # Add your sssecret token types like so. Default is "ft".
+  config.friendly_token_types[:user] = 'usr'
+  config.friendly_token_types[:admin] = 'adm'
+
+  # Any other Devise configuration...
+end
+```
+
+3. Call `Devise#friendly_token` with your desired parameters to generate friendly tokens based on the configured sssecrets prefixes and organization.
+
+## Example
+
+```ruby
+# Generate a friendly token with the default org 'dv' and default type of 'ft'
+token_with_default_prefix = Devise.friendly_token
+"dvft_3MU5bK5MChmzOmxCsQIhb7CEXgdcPj3tNmF9"
+
+# Generate a friendly token with the 'org' of 'test' and type of 'user'
+token_with_user_prefix = Devise.friendly_token(org: "test", prefix_type: :user)
+"testusr_cFl9hMJTxPRxpnHBmiUNgKizhilscT4RfLk2"
+
+# Generate a friendly token with the default 'org' and type of 'admin'
+token_with_admin_prefix = Devise.friendly_token(prefix_type: :admin)
+"dvadm_2Srrwf5IWVubTHmqBTVmvAraHgeCYO11ezUh"
+```
+
+## Tests
+
+Tests are included in this repository: 
+
+```shell
+bundle exec rspec spec/devise/sssecrets_spec.rb
+```
+
+## Development
+
+After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake spec` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
+
+To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and the created tag, and push the `.gem` file to [rubygems.org](https://rubygems.org).
+
+## Contributing
+
+Bug reports and pull requests are welcome on GitHub at https://github.com/[chtzvt]/devise-sssecrets.
+
+## License
+
+The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).

data/Rakefile

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+require "bundler/gem_tasks"
+require "rspec/core/rake_task"
+
+RSpec::Core::RakeTask.new(:spec)
+
+require "rubocop/rake_task"
+
+RuboCop::RakeTask.new
+
+task default: %i[spec rubocop]

data/devise-sssecrets.gemspec

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+require_relative "lib/devise/sssecrets/version"
+
+Gem::Specification.new do |spec|
+  spec.name = "devise-sssecrets"
+  spec.version = Devise::Sssecrets::VERSION
+  spec.authors = ["Charlton Trezevant"]
+
+  spec.summary = "Sssecrets module for Devise"
+  spec.homepage = "https://github.com/chtzvt/devise-sssecrets"
+  spec.license = "MIT"
+  spec.required_ruby_version = ">= 2.6.0"
+
+  spec.metadata["homepage_uri"] = spec.homepage
+  spec.metadata["source_code_uri"] = "https://github.com/chtzvt/devise-sssecrets"
+  spec.metadata["changelog_uri"] = "https://github.com/chtzvt/devise-sssecrets"
+
+  # Specify which files should be added to the gem when it is released.
+  # The `git ls-files -z` loads the files in the RubyGem that have been added into git.
+  spec.files = Dir.chdir(__dir__) do
+    `git ls-files -z`.split("\x0").reject do |f|
+      (File.expand_path(f) == __FILE__) ||
+        f.start_with?(*%w[bin/ test/ spec/ features/ .git .circleci appveyor Gemfile])
+    end
+  end
+  spec.bindir = "exe"
+  spec.executables = spec.files.grep(%r{\Aexe/}) { |f| File.basename(f) }
+  spec.require_paths = ["lib"]
+
+  # Uncomment to register a new dependency of your gem
+  # spec.add_dependency "example-gem", "~> 1.0"
+
+  # For more information and examples about making a new gem, check out our
+  # guide at: https://bundler.io/guides/creating_gem.html
+end

data/lib/devise/sssecrets/version.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module Devise
+  module Sssecrets
+    VERSION = "0.1.0"
+  end
+end

data/lib/devise/sssecrets.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+require "devise"
+require "sssecrets"
+
+# This module provides a devise extension to use Sssecrets instead
+# of Devise's default friendly token generator.
+#
+# Please consult the link below to learn more about Structured Secrets and
+# the sssecrets gem.
+#
+# @see https://github.com/chtzvt/sssecrets
+module Devise
+  mattr_accessor :friendly_token_types
+  mattr_accessor :friendly_token_org
+
+  # Configuration block to set multiple token prefixes with sssecrets types and org
+  # The available sssecret token prefixes (org and types) can be set up in your Devise
+  # configuration block:
+  #
+  #   Devise.setup do |config|
+  #    config.friendly_token_org = 'dv' # Set your sssecret token organization. Defaults to "dv".
+  #    config.friendly_token_types[:default] = 'ft' # Add your sssecret token types like so. Default is "ft".
+  #    config.friendly_token_types[:user] = 'usr'
+  #    config.friendly_token_types[:admin] = 'adm'
+  #    # Any other Devise configuration...
+  #   end
+  def self.setup
+    self.friendly_token_types = { default: "ft" }
+    self.friendly_token_org = "dv"
+    yield(self)
+  end
+
+  def self.sssecrets_type_for(type)
+    friendly_token_types[type] || friendly_token_types[:default] || "ft"
+  end
+
+  # The overridden Devise#friendly_token implementation has been extended to accept two optional parameters:
+  #
+  #  prefix_type: Specifies the type of the token prefix. If not provided, it defaults to :default.
+  #  org: Specifies the organization for the friendly token. If not provided, the default organization is used.
+  #
+  # Note: the original implementation's length parameter is now ignored.
+  def self.friendly_token(**kwargs)
+    type = kwargs[:type] || :default
+    org = kwargs[:org] || friendly_token_org || "dv"
+
+    generator = SimpleStructuredSecrets.new(org, sssecrets_type_for(type))
+    generator.generate
+  end
+end
+
+Devise.add_module(:sssecrets, insert_at: 0)

data/sig/devise/sssecrets.rbs

@@ -0,0 +1,6 @@
+module Devise
+  module Sssecrets
+    VERSION: String
+    # See the writing guide of rbs: https://github.com/ruby/rbs#guides
+  end
+end

metadata

@@ -0,0 +1,54 @@
+--- !ruby/object:Gem::Specification
+name: devise-sssecrets
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Charlton Trezevant
+autorequire:
+bindir: exe
+cert_chain: []
+date: 2023-07-25 00:00:00.000000000 Z
+dependencies: []
+description:
+email:
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- ".rspec"
+- ".rubocop.yml"
+- LICENSE.txt
+- README.md
+- Rakefile
+- devise-sssecrets.gemspec
+- lib/devise/sssecrets.rb
+- lib/devise/sssecrets/version.rb
+- sig/devise/sssecrets.rbs
+homepage: https://github.com/chtzvt/devise-sssecrets
+licenses:
+- MIT
+metadata:
+  homepage_uri: https://github.com/chtzvt/devise-sssecrets
+  source_code_uri: https://github.com/chtzvt/devise-sssecrets
+  changelog_uri: https://github.com/chtzvt/devise-sssecrets
+post_install_message:
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 2.6.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.4.17
+signing_key:
+specification_version: 4
+summary: Sssecrets module for Devise
+test_files: []