firebase_id_token 3.0.0 → 4.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b0bb2d6c4da0bacd15e8a551b29b48f3ee99018697334a437f11c5ee03bd2a11
-  data.tar.gz: 936cf705c0130dc0927e0b51811f3cba131970990c7ee5e480fe1705abde2e6f
+  metadata.gz: a7737e97a521a870ff07e83c63f2dbf0d72e89ba85858f42ae9443762518a15a
+  data.tar.gz: 20f27c0f72411d19d6f0efb29fb48528a31c5b6a9ccee7d42300ff61f08833c9
 SHA512:
-  metadata.gz: 62bf3a86a503fba14deac924a837b739c5cba3e7a93ad560a9f9f2b320edf704d7df33897b7422ebffbe47698252c49e00ab72cad3e08da1fb6e43066c0345cd
-  data.tar.gz: ad1a1ed121307e5b79d3943d9b37624bacf8b42f8b171642de6052d50bf313d7ec3f777f99d93f7f31233c45d1bb2365ba10fff3bede139458b9528d25c1a219
+  metadata.gz: 2e120f07c5e5017932ab02dcd7955bc3ee292ed360f6da45f56f739394488aa8ae41bab42ab30dbd1f4dd7f51e3dfeed6c3d3a1acd00925656e87be8253a3cda
+  data.tar.gz: a84b333fc8a2a9ad2cec07300ba4ad46a72b9685cebb9cfd0dcb7e2651a123cfed5732487851b76e0a0f8a2ef897989e417418eecf0d38375b287e582a0dd0c9

data/.github/workflows/test.yml

@@ -3,6 +3,7 @@ on:
   push:
     branches:
       - master
+  pull_request:
 
 jobs:
   test:
@@ -25,10 +26,3 @@ jobs:
         run: bundle install
       - name: Run tests
         run: bundle exec rspec
-      - name: Publish code coverage
-        uses: paambaati/codeclimate-action@v4.0.0
-        env:
-          CC_TEST_REPORTER_ID: ${{ secrets.CC_TEST_REPORTER_ID }}
-        with:
-          debug: true
-          coverageLocations: ${{github.workspace}}/coverage/coverage.json:simplecov

data/CHANGELOG.md

@@ -6,7 +6,40 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
-Nothing.
+## [4.0.0] - 2026-07-28
+
+### Added
+- Support for verifying Firebase Session Cookies with
+  `FirebaseIdToken::Signature.verify(cookie, type: :session_cookie)`. Session
+  Cookie certificates are downloaded from their own Google API URL and cached
+  apart from the ID Token ones.
+  [PR #46](https://github.com/fschuindt/firebase_id_token/pull/46).
+- Support for any `ActiveSupport::Cache` store through the new
+  `config.cache_store` configuration, with lazy certificate download on cache
+  miss, removing the need for Redis and scheduled certificate requests.
+  [PR #43](https://github.com/fschuindt/firebase_id_token/pull/43), closes
+  [issue #6](https://github.com/fschuindt/firebase_id_token/issues/6). The
+  legacy `config.redis` configuration keeps working as before.
+- A warning on `README.md` that `FirebaseIdToken.test!` must never be called
+  outside of a test suite, as the fixture private key is public in this
+  repository.
+- [Dev] `ostruct` as a development dependency, as it's no longer a default
+  gem in Ruby >= 3.5 and Pry requires it when running the specs.
+
+### Fixed
+- `Signature.verify` raised `NoMethodError` when a correctly signed token had
+  no `sub` claim, even with `raise_error: false`. It now returns `nil` as
+  documented.
+
+### Changed
+- Loosened the HTTParty dependency constraint to `>= 0.21, < 1.0`, allowing
+  newer releases. [Issue #44](https://github.com/fschuindt/firebase_id_token/issues/44).
+- CI now also runs on pull requests.
+
+### Removed
+- The Code Climate coverage publishing step and badges, as the service and
+  its GitHub Action are defunct. SimpleCov still reports coverage on every
+  test run.
 
 ## [3.0.0] - 2023-04-11
 
@@ -20,6 +53,7 @@ Nothing.
 - SimpleCov JSON formatter and `json` as dependency.
 
 ### Changed
+- Redis is no longer required. Any ActiveSupport cache will now work.
 - It won't default to `Redis.new` anymore. You must now provide Redis details during configuration. [Details here](https://github.com/fschuindt/firebase_id_token/issues/30).
 - Upgraded Redis to 5.0.6.
 - Upgraded Redis Namespace to 1.10.
@@ -152,6 +186,7 @@ Nothing.
 ## [0.1.0] - 2017-04-23
 *Version removed.*
 
+[4.0.0]: https://github.com/fschuindt/firebase_id_token/compare/3.0.0...4.0.0
 [3.0.0]: https://github.com/fschuindt/firebase_id_token/compare/2.5.2...3.0.0
 [2.5.2]: https://github.com/fschuindt/firebase_id_token/compare/2.5.1...2.5.2
 [2.5.1]: https://github.com/fschuindt/firebase_id_token/compare/2.5.0...2.5.1

data/Gemfile

@@ -2,3 +2,10 @@ source 'https://rubygems.org'
 
 # Specify your gem's dependencies in firebase_id_token.gemspec
 gemspec
+
+# connection_pool 3.x is incompatible with ActiveSupport 7.x's
+# RedisCacheStore (positional options hash vs keyword arguments).
+gem 'connection_pool', '< 3.0'
+
+# No longer a default gem in Ruby >= 3.5; needed by pry in the specs.
+gem 'ostruct'

data/README.md

@@ -1,26 +1,18 @@
-# Ruby Firebase ID Token verifier (pre-release)
+# Ruby Firebase ID Token verifier
 
-[![Actions Status](https://github.com/fschuindt/firebase_id_token/workflows/Test/badge.svg?branch=master)](https://github.com/fschuindt/firebase_id_token/actions?query=workflow%3ATest)
-[![Test Coverage](https://codeclimate.com/github/fschuindt/firebase_id_token/badges/coverage.svg)](https://codeclimate.com/github/fschuindt/firebase_id_token/coverage)
-[![Code Climate](https://codeclimate.com/github/fschuindt/firebase_id_token/badges/gpa.svg)](https://codeclimate.com/github/fschuindt/firebase_id_token)
-[![Issue Count](https://codeclimate.com/github/fschuindt/firebase_id_token/badges/issue_count.svg)](https://codeclimate.com/github/fschuindt/firebase_id_token)
-[![Inline docs](http://inch-ci.org/github/fschuindt/firebase_id_token.svg?branch=master)](http://inch-ci.org/github/fschuindt/firebase_id_token)
+[![Actions Status](https://github.com/fschuindt/firebase_id_token/actions/workflows/test.yml/badge.svg?branch=master)](https://github.com/fschuindt/firebase_id_token/actions/workflows/test.yml)
 
-A Ruby gem to verify the signature of Firebase ID Tokens (JWT). It uses Redis to store Google's x509 certificates and manage their expiration time, so you don't need to request Google's API in every execution and can access it as fast as reading from memory.
+A Ruby gem to verify the signature of Firebase ID Tokens (JWT). It uses ActiveSupport::Cache to store Google's x509 certificates and manage their expiration time, so you don't need to request Google's API in every execution and can access it as fast as reading from memory.
 
 It also checks the JWT payload parameters as recommended [here](https://firebase.google.com/docs/auth/admin/verify-id-tokens) by Firebase official documentation.
 
-Feel free to open any issue or to [contact me](https://fschuindt.github.io/blog/about/) directly.  
+Feel free to open any issue or to [contact me](https://fschuindt.github.io/blog/about/) directly.
 Any contribution is welcome.
 
 ## Docs
 
  + http://www.rubydoc.info/gems/firebase_id_token
 
-## Requirements
-
-+ Redis
-
 ## Installing
 
 ```
@@ -29,7 +21,7 @@ gem install firebase_id_token
 
 or in your Gemfile
 ```
-gem 'firebase_id_token', '~> 3.0.0'
+gem 'firebase_id_token', '~> 4.0.0'
 ```
 then
 ```
@@ -42,13 +34,27 @@ It's needed to set up your Firebase Project ID.
 
 If you are using Rails, this should probably go into `config/initializers/firebase_id_token.rb`.
 ```ruby
+FirebaseIdToken.configure do |config|
+  config.cache_store = ActiveSupport::Cache::RedisCacheStore.new
+  config.project_ids = ['your-firebase-project-id']
+end
+```
+
+You can use the old method of configuration as well. If you use this method, you'll have to proactively
+download certificates (see [Downloading Certificates](#downloading-certificates) below)
+```ruby
 FirebaseIdToken.configure do |config|
   config.redis = Redis.new
   config.project_ids = ['your-firebase-project-id']
 end
 ```
 
-- `redis` with a `Redis` instance must be supplied. You can configure your Redis details here. Example: `Redis.new(host: '10.0.1.1', port: 6380, db: 15)`.
+- A cache store instance inheriting from [ActiveSupport::Cache::Store](https://api.rubyonrails.org/classes/ActiveSupport/Cache/Store.html) must be supplied.
+  - Examples:
+    - `ActiveSupport::Cache::RedisCacheStore.new(Redis.new(host: '10.0.1.1', port: 6380, db: 15))`
+    - `ActiveSupport::Cache::MemoryStore.new(namespace: "firebase_auth")`
+    - `ActiveSupport::Cache::FileStore.new("cache", namespace: "firebase_auth")`
+    - `Rails.cache`
 - `project_ids` must be an Array.
 
 *If you want to verify signatures from more than one Firebase project, just add more Project IDs to the list.*
@@ -67,22 +73,22 @@ To do it, simply:
 FirebaseIdToken::Certificates.request
 ```
 
-It will download the certificates and save it in Redis, but only if the Redis certificates database is empty. To force download and override of the Redis database, use:
+It will download the certificates and save it in cache, but only if the cache certificates database is empty. To force download and override of the cache entries, use:
 ```ruby
 FirebaseIdToken::Certificates.request!
 ```
 
-Google give us information about the certificates' expiration time, it's used to set a Redis TTL (Time-To-Live) when saving it. By doing so, the certificates will be automatically deleted after its expiration.
+Google give us information about the certificates' expiration time, it's used to set a cache TTL (Time-To-Live) when saving it. By doing so, the certificates will be automatically deleted after its expiration.
 
 #### Certificates Info
 
-Checks the presence of certificates in the Redis database.
+Checks the presence of certificates in the cache.
 ```ruby
 FirebaseIdToken::Certificates.present?
 => true
 ```
 
-How many seconds until the certificate's expiration.
+How many seconds until the certificate's expiration. _NOTE_: Currently only functional when using Redis
 ```ruby
 FirebaseIdToken::Certificates.ttl
 => 22352
@@ -101,6 +107,8 @@ FirebaseIdToken::Certificates.find('ec8f292sd30224afac5c55540df66d1f999d')
 ```
 
 #### Downloading in Rails
+If you pass in the `cache_store` configuration option (see [configuration](#configuration)), the certificates will be
+requested at runtime when needed and you can ignore this section.
 
 If you are using Rails, it's clever to download certificates in a cron task, you can use [whenever](https://github.com/javan/whenever).
 
@@ -112,12 +120,12 @@ Create your task in `lib/tasks/firebase.rake`:
 ```ruby
 namespace :firebase do
   namespace :certificates do
-    desc "Request Google's x509 certificates when Redis is empty"
+    desc "Request Google's x509 certificates when the cache is empty"
     task request: :environment do
       FirebaseIdToken::Certificates.request
     end
 
-    desc "Request Google's x509 certificates and override Redis"
+    desc "Request Google's x509 certificates and override the cache"
     task force_request: :environment do
       FirebaseIdToken::Certificates.request!
     end
@@ -144,7 +152,7 @@ When developing, you should just run the task:
 $ rake firebase:certificates:request
 ```
 
-*You need Redis to be running.*
+*You need Redis to be running if you're using RedisCacheStore*
 
 ### Verifying Tokens
 
@@ -164,6 +172,21 @@ FirebaseIdToken::Signature.verify('aaaaaa')
 => nil
 ```
 
+#### Verifying Session Cookies
+
+[Firebase Session Cookies](https://firebase.google.com/docs/auth/admin/manage-cookies) are issued by `https://session.firebase.google.com` and signed by a different certificate set than ID Tokens. Pass `type: :session_cookie` to verify one:
+
+```ruby
+FirebaseIdToken::Signature.verify(session_cookie, type: :session_cookie)
+=> {"iss"=>"https://session.firebase.google.com/firebase-id-token", "name"=>"Bob Test", [...]}
+```
+
+When using the `cache_store` configuration, the Session Cookie certificates are downloaded automatically on the first verification, just like the ID Token ones. If you are on the legacy Redis configuration and download certificates with a cron task, you also need to request the Session Cookie certificates:
+
+```ruby
+FirebaseIdToken::Certificates.request(source: :session_cookie)
+```
+
 #### WARNING!
 
 ##### Expired tokens can point to long gone certificates
@@ -180,7 +203,7 @@ More details [here](https://github.com/fschuindt/firebase_id_token/issues/29).
 
 ##### Trying to verify tokens without downloaded certificates will raise an error
 
-If you try to verify a signature without any certificates in Redis database, it will raise a `FirebaseIdToken::Exceptions::NoCertificatesError`.
+If you try to verify a signature without any certificates in the cache, it will raise a `FirebaseIdToken::Exceptions::NoCertificatesError`.
 
 ##### "I keep on getting `nil` on `verify`"
 
@@ -190,7 +213,7 @@ Poorly synchronized clocks will sometimes make the server think the token's `iat
 
 In case you need, here's a example of the payload structure from a Google login in JSON.
 ```json
-{  
+{
    "iss":"https://securetoken.google.com/{{YOUR_FIREBASE_APP_ID}}",
    "name":"Ugly Bob",
    "picture":"https://someurl.com/photo.jpg",
@@ -202,12 +225,12 @@ In case you need, here's a example of the payload structure from a Google login
    "exp":33029000017, // needs to be in the future
    "email":"uglybob@emailurl.com",
    "email_verified":true,
-   "firebase":{  
-      "identities":{  
-         "google.com":[  
+   "firebase":{
+      "identities":{
+         "google.com":[
             "1010101010101010101"
          ],
-         "email":[  
+         "email":[
             "uglybob@emailurl.com"
          ]
       },
@@ -232,6 +255,12 @@ Just run:
 FirebaseIdToken.test!
 ```
 
+> **Warning**
+> `FirebaseIdToken.test!` replaces signature verification with a fixture
+> certificate whose private key is publicly available in this repository.
+> Never call it outside of your test suite. An application running in test
+> mode will accept forged tokens crafted by anyone.
+
 By using this mode, the following methods become available.
 
 ```ruby
@@ -268,7 +297,7 @@ module Api
         @routes = Engine.routes
         @user = users(:one)
       end
-        
+
       def create_token(sub: nil)
         _payload = payload.merge({sub: sub})
         JWT.encode _payload, OpenSSL::PKey::RSA.new(FirebaseIdToken::Testing::Certificates.private_key), 'RS256'

data/firebase_id_token.gemspec

@@ -11,7 +11,7 @@ Gem::Specification.new do |spec|
 
   spec.summary       = 'A Firebase ID Token verifier.'
   spec.description   = "A Ruby gem to verify the signature of Firebase ID "\
-    "Tokens. It uses Redis to store Google's x509 certificates and manage "\
+    "Tokens. It uses ActiveSupport::Cache to store Google's x509 certificates and manage "\
     "their expiration time, so you don't need to request Google's API in "\
     "every execution and can access it as fast as reading from memory."
   spec.homepage      = 'https://github.com/fschuindt/firebase_id_token'
@@ -29,10 +29,10 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency 'simplecov', '~> 0.22.0'
   spec.add_development_dependency 'simplecov_json_formatter', '~> 0.1.2'
   spec.add_development_dependency 'pry', '~> 0.14.2'
+  spec.add_development_dependency 'redis', '~> 5.0', '>= 5.0.6'
+  spec.add_development_dependency 'redis-namespace', '~> 1.10'
 
-  spec.add_runtime_dependency 'redis', '~> 5.0', '>= 5.0.6'
-  spec.add_runtime_dependency 'redis-namespace', '~> 1.10'
-  spec.add_dependency 'httparty', '~> 0.21.0'
+  spec.add_dependency 'httparty', '>= 0.21', '< 1.0'
   spec.add_runtime_dependency 'jwt', '~> 2.7'
   spec.add_runtime_dependency 'activesupport', '~> 7.0', '>= 7.0.4.3'
   spec.add_runtime_dependency 'json', '~> 2.6', '>= 2.6.3'

data/lib/firebase_id_token/certificates/active_support.rb

@@ -0,0 +1,92 @@
+module FirebaseIdToken
+  # ActiveSupport specific methods for Certificates class
+  class Certificates::ActiveSupport < Certificates
+    attr_reader :cache_store
+    RACE_CONDITION_TIME = 5.seconds
+
+    def initialize(source: :id_token)
+      @source = source
+      @cache_store = ::FirebaseIdToken.configuration.cache_store
+      @local_certs = read_certificates
+    end
+
+    def self.ttl(source: :id_token)
+      current_time = Time.now.to_i
+      entry = new(source: source).cache_store.read CACHE_KEYS.fetch(source)
+      if entry
+        expires_at = JSON.parse(entry)["expires_at"]
+        return expires_at - current_time < 0 ? 0 : expires_at - current_time
+      end
+      return 0
+    end
+
+    private
+
+    def read_certificates
+      entry = cache_store.read(cache_key)
+      if entry.nil?
+        lock do
+          request!
+        end
+        entry = cache_store.read(cache_key)
+      end
+      certs = {}
+      certs = JSON.parse(JSON.parse(entry)["data"]) if entry
+      certs
+    rescue StandardError => e
+      return {}
+    end
+
+    # we can't use ActiveSupport's fetch, because we need to set the expiration time of
+    # the key based on a value we read from the request. This is a rudimentary mutex instead
+    def lock
+      acquire_lock
+      yield
+    ensure
+      release_lock
+    end
+
+    def acquire_lock
+      maybe_sleep
+      cache_store.write(lock_key, true, expires_in: 5.seconds)
+    end
+
+    def maybe_sleep
+      iteration = 0
+      while cache_store.exist?(lock_key)
+        iteration += 1
+        sleep 1
+        break if iteration > 5
+      end
+    end
+
+    def release_lock
+      cache_store.delete(lock_key)
+    end
+
+    def lock_key
+      "#{cache_key}_lock"
+    end
+
+    def save_certificates
+      expires_at = Time.now.to_i + ttl
+      # set the expiration of the key to the certification expiration - RACE_CONDITION_TIME, so that the entry
+      # will be expired before the certificate is
+      cache_store.write cache_key, { data: @request.body, expires_at: expires_at }.to_json,
+        expires_in: (ttl - RACE_CONDITION_TIME)
+      @local_certs = @request.body
+    end
+
+    def ttl
+      cache_control = @request.headers['cache-control']
+      ttl = cache_control.match(/max-age=([0-9]+)/).captures.first.to_i
+
+      if ttl > 3600
+        ttl
+      else
+        raise ::FirebaseIdToken::Exceptions::CertificatesTtlError
+      end
+    end
+  end
+end
+

data/lib/firebase_id_token/certificates/redis.rb

@@ -0,0 +1,46 @@
+module FirebaseIdToken
+  # Redis specific methods for Certificates class
+  class Certificates::Redis < Certificates
+    attr_reader :redis
+
+    def initialize(source: :id_token)
+      @source = source
+      @redis = ::Redis::Namespace.new('firebase_id_token',
+        redis: FirebaseIdToken.configuration.redis)
+      @local_certs = read_certificates
+    end
+
+    # Returns the current certificates TTL (Time-To-Live) in seconds. *Zero
+    # meaning no certificates.* It's the same as the certificates expiration
+    # time, use it to know when to request again.
+    # @return [Fixnum]
+    def self.ttl(source: :id_token)
+      ttl = new(source: source).redis.ttl(CACHE_KEYS.fetch(source))
+      ttl < 0 ? 0 : ttl
+    end
+
+    private
+
+    def read_certificates
+      certs = @redis.get cache_key
+      certs ? JSON.parse(certs) : {}
+    end
+
+    def save_certificates
+      @redis.setex cache_key, ttl, @request.body
+      @local_certs = read_certificates
+    end
+
+    def ttl
+      cache_control = @request.headers['cache-control']
+      ttl = cache_control.match(/max-age=([0-9]+)/).captures.first.to_i
+
+      if ttl > 3600
+        ttl
+      else
+        raise Exceptions::CertificatesTtlError
+      end
+    end
+  end
+end
+