fb-jwt-auth 0.2.2 → 0.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a361b57c2b001ce5d99eae92c8c90536a478d0e27e5d93417dfa157dfc92fc54
-  data.tar.gz: e9ec232adbdc8bc109a9f6e27e57fb5ac17a2289d69ba029dbde7b6f71f928b0
+  metadata.gz: 206e6cea51b7085e81edf9e3abbab0d328d947797d7eda4f9ddc33b63559f3ce
+  data.tar.gz: ab5e1d4604fe50e8d41ade6996ec55faec9f3803612d4e9dc8f6a63930fc05a9
 SHA512:
-  metadata.gz: d742d7ede999d0695a3d72da858c8c8314382b31539f4df7156c97c5ea01e45e0b4833952b05eeffd97fc172b6a675726829282e2ad594654d445dacf5220e9d
-  data.tar.gz: 45366b1a2238884d9b1cd5818dde5ef5f63340461d15867eb86b7e6852f132876baf3174c14397e25cc0d7d4b0093fa9867628b05a85015d95693ad583b69b86
+  metadata.gz: 6ee2f83dda3dc556684729d306b2e33b5493b637e27a997bf8559a730b4cd8d6e5e00366f7d84284cef05f56e8bad861a941ad8a2c1390fcf5c0badd072a2a72
+  data.tar.gz: 0b4c2bedf35ea43dee2e0ccb1b0d67b547b7d121c1930b48d1e3a44a018f980f472423edd4f9a556cf78977957261423f0eaa144cf890c1de53cdd087d7e48bc

data/.circleci/config.yml

@@ -5,7 +5,7 @@ orbs:
 jobs:
   test:
     docker:
-      - image: cimg/ruby:2.7.2
+      - image: cimg/ruby:2.7.3
     steps:
       - checkout
       - run:
@@ -21,7 +21,7 @@ jobs:
           include_job_number_field: false
   publish:
     docker:
-      - image: cimg/ruby:2.7.2
+      - image: cimg/ruby:2.7.3
     steps:
       - checkout
       - run:

data/.ruby-version

@@ -1 +1 @@
-2.7.2
+2.7.3

data/Changelog.md

@@ -1,3 +1,21 @@
+# 0.7.0
+* Use Ruby 2.7.3
+
+# 0.6.0
+* Supplier issuer to service token client
+
+# 0.5.0
+* Do not base64 decode private key
+
+# 0.4.0
+* Generate the access token
+
+# 0.3.0
+* Request non cached version of public key if first validition fails
+
+# v0.2.2
+* Add token not present exception when token is empty
+
 # v0.2.1
 * Add better error messages
 

data/README.md

@@ -25,6 +25,16 @@ Fb::Jwt::Auth.configure do |config|
   config.service_token_cache_root_url = ENV['SERVICE_TOKEN_CACHE_ROOT_URL']
 end
 ```
+In order to generate the service access token we need to use `Fb::Jwt::Auth::ServiceAccessToken.new.generate` or if you require a subject, `Fb::Jwt::Auth::ServiceAccessToken.new(subject: subject).generate`
+
+In the case you need to configure the service access token as a client
+```ruby
+Fb::Jwt::Auth.configure do |config|
+  config.issuer = 'fb-editor'
+  config.namespace = 'formbuilder-saas-test'
+  config.encoded_private_key = 'base64 encoded private key'
+end
+```
 
 ### Using other endpoint versions
 

data/lib/fb/jwt/auth.rb

@@ -1,18 +1,23 @@
 require 'fb/jwt/auth/version'
 require 'openssl'
 require 'jwt'
-require 'active_support/core_ext'
+require 'active_support/all'
 
 module Fb
   module Jwt
     class Auth
-      cattr_accessor :service_token_cache_root_url, :service_token_cache_api_version
+      cattr_accessor :service_token_cache_root_url,
+                     :service_token_cache_api_version,
+                     :encoded_private_key,
+                     :issuer,
+                     :namespace
 
       def self.configure(&block)
         yield self
       end
 
       autoload :ServiceTokenClient, 'fb/jwt/auth/service_token_client'
+      autoload :ServiceAccessToken, 'fb/jwt/auth/service_access_token'
 
       class TokenNotPresentError < StandardError
       end
@@ -44,8 +49,7 @@ module Fb
         application_details = find_application_info
 
         begin
-          hmac_secret = public_key(application_details)
-          payload, _header = decode(hmac_secret: hmac_secret)
+          payload, _header = retrieve_and_decode_public_key(application_details)
         rescue StandardError => e
           error_message = "Token is not valid: error #{e}"
           logger.debug(error_message)
@@ -67,6 +71,15 @@ module Fb
         payload
       end
 
+      def retrieve_and_decode_public_key(application_details)
+        hmac_secret = public_key(application_details)
+        decode(hmac_secret: hmac_secret)
+      rescue JWT::VerificationError
+        logger.debug('First validation failed. Requesting non cached public key')
+        hmac_secret = public_key(application_details.merge(ignore_cache: true))
+        decode(hmac_secret: hmac_secret)
+      end
+
       def decode(verify: true, hmac_secret: nil)
         JWT.decode(
           token,

data/lib/fb/jwt/auth/service_access_token.rb

@@ -0,0 +1,43 @@
+module Fb
+  module Jwt
+    class Auth
+      class ServiceAccessToken
+        attr_reader :encoded_private_key,
+                    :issuer,
+                    :subject,
+                    :namespace
+
+        def initialize(subject: nil, issuer: nil)
+          @subject = subject
+          @encoded_private_key = Fb::Jwt::Auth.encoded_private_key
+          @namespace = Fb::Jwt::Auth.namespace
+          @issuer = issuer || Fb::Jwt::Auth.issuer
+        end
+
+        def generate
+          return '' if encoded_private_key.blank?
+
+          private_key = OpenSSL::PKey::RSA.new(encoded_private_key.chomp)
+
+          JWT.encode(
+            token,
+            private_key,
+            'RS256'
+          )
+        end
+
+        private
+
+        def token
+          payload = {
+            iss: issuer,
+            iat: Time.current.to_i
+          }
+          payload[:sub] = subject if subject.present?
+          payload[:namespace] = namespace if namespace.present?
+          payload
+        end
+      end
+    end
+  end
+end

data/lib/fb/jwt/auth/service_token_client.rb

@@ -12,9 +12,10 @@ class Fb::Jwt::Auth::ServiceTokenClient
 
   attr_accessor :application, :namespace, :root_url, :api_version
 
-  def initialize(application:, namespace: nil)
+  def initialize(application:, namespace: nil, ignore_cache: false)
     @application = application
     @namespace = namespace
+    @ignore_cache = ignore_cache
     @root_url = Fb::Jwt::Auth.service_token_cache_root_url
     @api_version = Fb::Jwt::Auth.service_token_cache_api_version || :v2
   end
@@ -38,8 +39,14 @@ class Fb::Jwt::Auth::ServiceTokenClient
 
   private
 
+  attr_reader :ignore_cache
+
   def public_key_uri
-    URI.join(root_url, version_url)
+    URI.join(root_url, "#{version_url}#{query_param}")
+  end
+
+  def query_param
+    ignore_cache ? '?ignore_cache=true' : ''
   end
 
   def version_url

data/lib/fb/jwt/auth/version.rb

@@ -1,7 +1,7 @@
 module Fb
   module Jwt
     class Auth
-      VERSION = "0.2.2"
+      VERSION = "0.7.0"
     end
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: fb-jwt-auth
 version: !ruby/object:Gem::Version
-  version: 0.2.2
+  version: 0.7.0
 platform: ruby
 authors:
 - Form builder developers
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-10-29 00:00:00.000000000 Z
+date: 2021-05-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: jwt
@@ -73,6 +73,7 @@ files:
 - bin/setup
 - fb-jwt-auth.gemspec
 - lib/fb/jwt/auth.rb
+- lib/fb/jwt/auth/service_access_token.rb
 - lib/fb/jwt/auth/service_token_client.rb
 - lib/fb/jwt/auth/version.rb
 homepage: https://github.com/ministryofjustice/fb-jwt-auth
@@ -97,7 +98,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.4
+rubygems_version: 3.2.15
 signing_key: 
 specification_version: 4
 summary: JWT authentication done in form builder team