epb-auth-tools 1.0.4 → 1.0.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 921d8a6fffad370eba86a5491178392f0ea95ff40d6f020774cc5c55ed02468c
-  data.tar.gz: 7ca0793ed0da0a9868cfde3a20ff7fd505f8a46796e0315df5b63b353b1e9646
+  metadata.gz: 51ff1680c92485230dcdd83f6d87a7346f7cd74e1f4d4df5cc556df606b39e60
+  data.tar.gz: c1179b6b77dfcf84f70f962c3a82229f1bbdc08dede87c232441d52eee6eed02
 SHA512:
-  metadata.gz: c3c7cb460788a06d9176b807aff72d66b9ec58d8040a7e204c1188945c8d00dc782e3f5f597fcbeec2dbb3f85aa2c00e6cf60122e50af283dd410d50adab22e1
-  data.tar.gz: 6a4bb45c6f580904c15a5c66e4da0e6c486f1b2cf9d17dbe897a6292be8d0b0300ccbf77371b64a1757d0bd5f605c94564f8549a104e41d01092a9baf2350014
+  metadata.gz: afeedf14c33ef8d100f06afdcea24fc5825b327c1723044517b46739f255924d48dd51d545f024c409fac97b63647a206c8912a7cccaddae9464414b9457df56
+  data.tar.gz: 0f65a346cf7aeec3ca38a032e6daa26261283ab7451781231beae77ce966870b96e6661d38182800c8bdc0e2cd469de7528a8118058aeafa77d107711f0e0547

data/lib/epb-auth-tools.rb

@@ -1,10 +1,10 @@
 # frozen_string_literal: true
 
 module Auth
-  require_relative 'errors'
-  require_relative 'http_client'
-  require_relative 'token'
-  require_relative 'token_processor'
+  require_relative "errors"
+  require_relative "http_client"
+  require_relative "token"
+  require_relative "token_processor"
 
-  require_relative 'sinatra/conditional'
+  require_relative "sinatra/conditional"
 end

data/lib/errors.rb

@@ -2,35 +2,73 @@
 
 module Auth
   module Errors
-    class Error < RuntimeError; end
+    class Error < RuntimeError
+    end
 
-    class Processor < Auth::Errors::Error; end
-    class ProcessorHasNoSecret < Auth::Errors::Error; end
-    class ProcessorHasNoIssuer < Auth::Errors::Error; end
+    class Processor < Auth::Errors::Error
+    end
 
-    class Token < Auth::Errors::Error; end
+    class ProcessorHasNoSecret < Auth::Errors::Error
+    end
 
-    class TokenMissing < Auth::Errors::Token; end
-    class TokenPayloadError < Auth::Errors::Token; end
-    class TokenExpired < Auth::Errors::TokenPayloadError; end
-    class TokenNotYetValid < Auth::Errors::TokenPayloadError; end
-    class TokenHasNoIssuer < Auth::Errors::TokenPayloadError; end
-    class TokenHasNoSubject < Auth::Errors::TokenPayloadError; end
-    class TokenHasNoIssuedAt < Auth::Errors::TokenPayloadError; end
-    class TokenHasNoExpiry < Auth::Errors::TokenPayloadError; end
-    class TokenIssuerIncorrect < Auth::Errors::TokenPayloadError; end
+    class ProcessorHasNoIssuer < Auth::Errors::Error
+    end
 
-    class TokenDecodeError < Auth::Errors::Token; end
-    class TokenTamperDetected < Auth::Errors::TokenDecodeError; end
+    class Token < Auth::Errors::Error
+    end
 
-    class Client < Auth::Errors::Error; end
+    class TokenMissing < Auth::Errors::Token
+    end
 
-    class ClientHasNoAuthServer < Auth::Errors::Client; end
-    class ClientHasNoClientId < Auth::Errors::Client; end
-    class ClientHasNoClientSecret < Auth::Errors::Client; end
-    class ClientHasNoBaseUri < Auth::Errors::Client; end
+    class TokenPayloadError < Auth::Errors::Token
+    end
 
-    class Network < Auth::Errors::Error; end
-    class NetworkConnectionFailed < Auth::Errors::Network; end
+    class TokenExpired < Auth::Errors::TokenPayloadError
+    end
+
+    class TokenNotYetValid < Auth::Errors::TokenPayloadError
+    end
+
+    class TokenHasNoIssuer < Auth::Errors::TokenPayloadError
+    end
+
+    class TokenHasNoSubject < Auth::Errors::TokenPayloadError
+    end
+
+    class TokenHasNoIssuedAt < Auth::Errors::TokenPayloadError
+    end
+
+    class TokenHasNoExpiry < Auth::Errors::TokenPayloadError
+    end
+
+    class TokenIssuerIncorrect < Auth::Errors::TokenPayloadError
+    end
+
+    class TokenDecodeError < Auth::Errors::Token
+    end
+
+    class TokenTamperDetected < Auth::Errors::TokenDecodeError
+    end
+
+    class Client < Auth::Errors::Error
+    end
+
+    class ClientHasNoAuthServer < Auth::Errors::Client
+    end
+
+    class ClientHasNoClientId < Auth::Errors::Client
+    end
+
+    class ClientHasNoClientSecret < Auth::Errors::Client
+    end
+
+    class ClientHasNoBaseUri < Auth::Errors::Client
+    end
+
+    class Network < Auth::Errors::Error
+    end
+
+    class NetworkConnectionFailed < Auth::Errors::Network
+    end
   end
 end

data/lib/http_client.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require 'oauth2'
+require "oauth2"
 
 module Auth
   class HttpClient
@@ -21,11 +21,10 @@ module Auth
       @authenticated_client = nil
 
       site_url = URI.parse(auth_server)
-      token_url = site_url.path + '/oauth/token'
-      authorisation_url = site_url.path + '/oauth/token'
+      token_url = "#{site_url.path}/oauth/token"
+      authorisation_url = "#{site_url.path}/oauth/token"
       site_url = "#{site_url.scheme}://#{site_url.host}:#{site_url.port}"
 
-
       @base_uri = base_uri
       @client =
         auth_client.new client_id,
@@ -61,8 +60,9 @@ module Auth
 
       if @authenticated_client.respond_to? method_name
         response = @authenticated_client.send method_name, *args, &block
-        if response.body.is_a?(::Hash) &&
-             response.body[:error] == 'Auth::Errors::TokenExpired'
+        if response.status == 401
+          # a 401 here is assumed to be due to an expired token
+          # otherwise, refreshing the token and calling again should make no difference to the ultimate response
           refresh
           response = @authenticated_client.send method_name, *args, &block
         end

data/lib/sinatra/conditional.rb

@@ -4,9 +4,9 @@ module Auth
   module Sinatra
     class Conditional
       def self.process_request(env)
-        jwt_token = env.fetch('HTTP_AUTHORIZATION', '').slice(7..-1)
+        jwt_token = env.fetch("HTTP_AUTHORIZATION", "").slice(7..-1)
         processor =
-          Auth::TokenProcessor.new ENV['JWT_SECRET'], ENV['JWT_ISSUER']
+          Auth::TokenProcessor.new ENV["JWT_SECRET"], ENV["JWT_ISSUER"]
         processor.process jwt_token
       end
     end

data/lib/token.rb

@@ -7,35 +7,35 @@ module Auth
       validate_payload
     end
 
+    def sub
+      @payload["sub"]
+    end
+
     def scope?(scope)
-      @payload['scopes']&.include? scope
+      @payload["scopes"]&.include? scope
     end
 
     def scopes?(scopes)
-      scopes.all? { |scope| @payload['scopes']&.include? scope }
+      scopes.all? { |scope| @payload["scopes"]&.include? scope }
     end
 
     def supplemental(property = nil)
-      unless property.nil? || @payload['sup'][property].nil?
-        return @payload['sup'][property]
-      end
+      return @payload["sup"][property] unless property.nil? || @payload["sup"][property].nil?
 
-      @payload['sup']
+      @payload["sup"]
     end
 
     def encode(jwt_secret)
-      JWT.encode @payload, jwt_secret, 'HS256'
+      JWT.encode @payload, jwt_secret, "HS256"
     end
 
-    private
+  private
 
     def validate_payload
-      raise Auth::Errors::TokenHasNoIssuer unless @payload.key?('iss')
-      raise Auth::Errors::TokenHasNoIssuedAt unless @payload.key?('iat')
-      unless @payload['iat'] <= Time.now.to_i
-        raise Auth::Errors::TokenNotYetValid
-      end
-      raise Auth::Errors::TokenHasNoSubject unless @payload.key?('sub')
+      raise Auth::Errors::TokenHasNoIssuer unless @payload.key?("iss")
+      raise Auth::Errors::TokenHasNoIssuedAt unless @payload.key?("iat")
+      raise Auth::Errors::TokenNotYetValid unless @payload["iat"] <= Time.now.to_i
+      raise Auth::Errors::TokenHasNoSubject unless @payload.key?("sub")
     end
   end
 end

data/lib/token_processor.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-require 'jwt'
+require "jwt"
 
 module Auth
   class TokenProcessor
@@ -17,19 +17,17 @@ module Auth
 
       payload, _header = jwt_process token
 
-      raise Auth::Errors::TokenExpired unless payload.key?('exp')
-      raise Auth::Errors::TokenHasNoIssuer unless payload.key?('iss')
-      unless payload['iss'] == @jwt_issuer
-        raise Auth::Errors::TokenIssuerIncorrect
-      end
+      raise Auth::Errors::TokenExpired unless payload.key?("exp")
+      raise Auth::Errors::TokenHasNoIssuer unless payload.key?("iss")
+      raise Auth::Errors::TokenIssuerIncorrect unless payload["iss"] == @jwt_issuer
 
       Auth::Token.new payload
     end
 
-    private
+  private
 
     def jwt_process(token)
-      options = { algorithm: 'HS256', iss: @jwt_issuer }
+      options = { algorithm: "HS256", iss: @jwt_issuer }
 
       JWT.decode token, @jwt_secret, true, options
     rescue JWT::ExpiredSignature

metadata

@@ -1,16 +1,19 @@
 --- !ruby/object:Gem::Specification
 name: epb-auth-tools
 version: !ruby/object:Gem::Version
-  version: 1.0.4
+  version: 1.0.9
 platform: ruby
 authors:
 - Lawrence Goldstien <lawrence.goldstien@madetech.com>
 - Yusuf Sheikh <yusuf@madetech.com>
 - Jaseera <jaseera@madetech.com>
-autorequire: 
+- Kevin Keenoy <kevin.keenoy@levellingup.gov.uk>
+- Douglas Greenshields <douglas.greenshields@levellingup.gov.uk>
+- Aga Dufrat <aga.dufrat@levellingup.gov.uk>
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2020-03-11 00:00:00.000000000 Z
+date: 2021-06-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jwt
@@ -18,14 +21,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.2'
+        version: '2.3'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.2'
+        version: '2.3'
 - !ruby/object:Gem::Dependency
   name: oauth2
   requirement: !ruby/object:Gem::Requirement
@@ -40,8 +43,8 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.4'
-description: 
-email: 
+description:
+email:
 executables: []
 extensions: []
 extra_rdoc_files: []
@@ -56,7 +59,7 @@ homepage: https://github.com/communitiesuk/epb-auth-tools
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -64,15 +67,15 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: 2.7.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.6
-signing_key: 
+rubygems_version: 3.1.6
+signing_key:
 specification_version: 4
 summary: Tools for authentication and authorisation with JWTs and OAuth
 test_files: []